CVE-2026-82090

Pocket (the save-for-later service and its app) versions through 8.33.0.0 are vulnerable to cross-site scripting (CWE-79): the 'Save to Pocket' feature injects external HTML fetched with saved content directly into the app's DOM without sufficient sanitization. An attacker who controls that external content - for example via a crafted page or resource that gets saved - can have arbitrary JavaScript executed inside the app's web context. The injected JavaScript can then invoke native bridge methods to alter the application's state, producing high impact on the confidentiality, integrity, and availability of the app and its data (CVSS 4.0 base score 9.2, critical). All users running Pocket at or below version 8.33.0.0 are affected; the vector indicates no privileges are required, though exploitation depends on specific conditions (attack requirements present). There is no known exploitation in the wild: no public proof-of-concept exists, the flaw is not in CISA KEV, and EPSS is 0.3% (20th percentile).

What to do: Update Pocket to the first release after 8.33.0.0 as soon as a patched version is published (no fixed version is documented in the available data); until then, avoid saving pages from untrusted or attacker-influenced sources and monitor for a vendor advisory. Given the absence of a public PoC, no KEV listing, and EPSS of 0.3%, prioritize this as important but not urgent.