AI analysis
Readwise Reader for Android builds URLs in its WebView by interpolating attacker-controlled document metadata without URL, HTML, or JavaScript encoding, then inserts the result into the DOM via innerHTML, allowing a malicious metadata value to break out of the URL and execute injected script (stored cross-site scripting, CWE-79). The attack is triggered when a victim synchronizes a document containing malicious metadata into their Reader library and renders it in the Android app, which is plausible via Reader's document-intake channels such as email-to-Reader, RSS/epub uploads, or shared documents; the vector requires user interaction (AV:N/PR:N/UI:R, CVSS 3.1 score 6.1). Successful exploitation gives the attacker script execution in the WebView context, enabling theft of session tokens or other accessible data and manipulation of app content, with low confidentiality and integrity impact. Version 8.7.2 is confirmed vulnerable per CERT/CC (VU#699627), and the vulnerability is scoped to the Android client rather than Readwise's servers. There is no evidence of exploitation in the wild, no public proof of concept, and the flaw is not on the CISA KEV list.
What to do: Update Readwise Reader for Android to the latest version available in the Play Store, since 8.7.2 is the version identified as vulnerable and no patched version number has been published in the advisory data. Until updated, be cautious about synchronizing or opening documents from untrusted senders, particularly documents arriving via the Reader email address, RSS feeds, or shared links, since the XSS fires when a crafted document is rendered in the WebView. Defenders should watch for anomalous script or unexpected content behavior in the Reader Android client and monitor CERT/CC VU#699627 for updated fix information.
Affected
| Readwise Reader for Android | 8.7.2 (other versions not specified in the advisory) |
Estimated exposure
largeon the order of 100,000 Android installs (roughly 10^5, clearly an estimate) — Readwise Reader is a popular subscription read-it-later service and its Android app has public Play Store download counts in the ~100K+ range, so the vulnerable install base is plausibly in the low hundreds of thousands, with only a subset…
Description
Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or JavaScript context encoding, a crafted metadata value can break out of the intended URL structure and inject script content. An attacker could supply a document containing malicious metadata that, once synchronized to an Android device and rendered in the Reader WebView, results in execution of injected script content, enabling stored cross-site scripting (XSS)