VU#699627: Readwise Reader for Android, version 8.7.2, contains multiple XSS vulnerabilities
CERT/CC discloses three stored XSS flaws in Readwise Reader Android 8.7.2 that can run JavaScript in WebView.
CERT/CC published VU#699627 on three stored XSS vulnerabilities in Readwise Reader for Android 8.7.2. CVE-2026-18311 and CVE-2026-18312 let poisoned document or URL metadata inject JavaScript that runs in the app WebView after sync. CVE-2026-18320 bypasses sanitize-html through a wildcard attribute rule on SVG and PATH elements, allowing onload and onerror handlers. Readwise could not be reached; version 8.10.1 patches the sanitizer-wildcard issue, and no in-the-wild exploitation is reported.
- Three stored XSS flaws affect Readwise Reader for Android 8.7.2.
- Poisoned metadata and SVG markup can run JavaScript in the WebView.
- Successful exploitation could expose documents, credentials, and session tokens.
- Version 8.10.1 patches the sanitizer-wildcard issue; vendor was not reached.
- Vendors
- Readwise
- Products
- Readwise Reader
- Organizations
- CERT/CC
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-18311+2 related CVEs | Stored Cross-Site Scripting in Readwise Reader for Android via Imported Document Metadata | 6.1 | — |
From the original article
2 min read at kb.cert.orgOverview Three cross-site scripting (XSS) vulnerabilities identified in Readwise Reader for Android version 8. 7. 2 are disclosed.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.