CVE-2026-18320

Readwise Reader for Android uses a sanitize-html configuration with a wildcard rule that permits all attributes on SVG and PATH elements, so script-capable event handler attributes such as 'onload' and 'onerror' are not stripped. An attacker can craft a document containing malicious SVG content that survives sanitization and executes script when the document is rendered in the Reader WebView, yielding client-side cross-site scripting. Exploitation requires the victim to open a malicious document in the app (user interaction is required per the CVSS vector), and a successful attack gives the attacker limited confidentiality and integrity impact within the WebView context, such as stealing session data or manipulating displayed content. Users of Readwise Reader on Android, specifically version 8.7.2 identified in CERT/CC VU#699627, are affected. No public proof-of-concept exists and the flaw is not in the CISA Known Exploited Vulnerabilities catalog, so exploitation status is currently none known.

What to do: Update Readwise Reader for Android to the latest version from Google Play as soon as a fixed release ships, since the data identifies 8.7.2 as vulnerable but does not specify a patched version number. Until patched, avoid saving or opening documents from untrusted or unknown sources in Reader, since exploitation requires rendering an attacker-supplied document. Monitor CERT/CC VU#699627 for vendor advisories and fixed-version details.