Vulnerability Bulletins |
CVE-2026-106716 |
|
| Affected software | ANDROID |
| ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. After a user opens the crafted link, the page can invoke getUserInfo, getCredentials, and initUser to obtain user metadata and an encrypted credential payload. | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-106716 | |