Stored Cross-Site Scripting in Readwise Reader for Android via Imported Document Metadata
AI analysis
Readwise Reader for Android (version 8.7.2) fails to sanitize HTML in document metadata during import, so attacker-controlled fields such as the author meta tag are rendered into a WebView via innerHTML. An attacker crafts a webpage or document whose metadata contains malicious script; when a victim saves it to Readwise and later opens it, the script executes in the app on any synced device. Because the WebView context can reach the app's session and data, successful exploitation can lead to theft of session tokens and unauthorized access to the victim's Readwise account content. All users of the affected Android version who save or sync content from untrusted web sources are potentially exposed, and the issue is tracked alongside multiple related XSS flaws in CERT/CC advisory VU#699627. No public proof of concept is known and there is no evidence of exploitation in the wild.
What to do: Update Readwise Reader for Android to the latest version from Google Play as soon as a patched release beyond 8.7.2 is available. Until then, avoid saving or opening documents from unfamiliar web sources, and review recently saved items for suspicious or garbled author/metadata fields. Users who observed unexpected behavior after opening a saved document should sign out of other sessions and rotate their Readwise credentials.
Affected
| Readwise Reader for Android | 8.7.2 (version identified in VU#699627; other versions may also be affected pending vendor confirmation) |
Estimated exposure
large≈100,000+ Android users (Readwise Reader Android app shows a 100K+ install bracket on Google Play) — Estimated from the app's Google Play install count for the Android client; the practically at-risk subset is smaller, limited to users who save or sync documents from untrusted sources, so this is clearly an order-of-magnitude estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced devices when the malicious document is opened.