Attributed metadata history
Up to 100 retained publisher events per page for 77b43aca8b36012c9b275cb2f799e76a923ae560bc3b1b9fd7973989127a1355. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_cd638cf167c7c119d6
observed · 2026-10-12 15:23:03 UTC
available
Fingerprint: e9e546feaa1a197f9c3a53bee19e29f6899cd295cb68e67b1de5b309ac3481e8
intelligence_src_cd638cf167c7c119d6
observed · 2026-10-12 15:23:03 UTC
Overview Three cross-site scripting (XSS) vulnerabilities identified in Readwise Reader for Android version 8.7.2 are disclosed. An attacker with the ability to craft malicious documents or metadata can exploit these vulnerabilities by supplying poisoned content that bypasses sanitization. Successful exploitation could allow the attacker to execute arbitrary JavaScript within the application's WebView context and compromise the confidentiality and integrity of user data, including access to stored documents, credentials, and session tokens. Description Readwise Reader from Readwise is designed to provide a unified read-it-later service that helps individuals collect and organize articles, newsletters, videos, and other content of interest into a single reading interface. It is available on multiple platforms including Android and can synchronize content across devices. CVE-2026-18311: A stored cross-site scripting (XSS) vulnerability in the header rendering component in Readwise Reader for Android version 8.7.2 allows remote attackers to execute arbitrary JavaScript via crafted document metadata fields. The header rendering component is impacted due to insufficient HTML escaping of
Fingerprint: 25f86ae72958a5f4e9a9ae2190d08f19f7e81a50f7489e0f75b89e02c8134867