Deep link exposes JavaScript bridges in ReelShort for Android
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- No fix listed
No CVSS vector from any source. Fix status from CNA.
Summary
ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl passed through its cmsvictor://open deep link in a WebView. The WebView exposes the Android and Offerwall JavaScript bridges without validating the page origin. After a user opens a crafted link, the page can call getUserInfo, getCredentials, and initUser to obtain user metadata and an encrypted credential payload.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. After a user opens the crafted link, the page can invoke getUserInfo, getCredentials, and initUser to obtain user metadata and an encrypted credential payload.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for ReelShort for Android.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Timeline
- 2026-11-05 Threatist record created from CVE-2026-106716
- 2026-11-05 Alias added: GHSA-hg37-j5x8-28c9
References
Sources
- CVE-2026-106716 · CVE Program
- CVE-2026-106716 · NVD
- FIRST EPSS
- GHSA-hg37-j5x8-28c9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences