CVE-2026-82090

9.2 criticalEPSS 0.4%

Critical (9.2). EPSS 0.4% chance of exploitation in the next 30 days.

Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods.

Severity

CVSS 4.0

9.2 critical

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-08-28
Modified: 2026-09-09
Record from: the NVD, synced 2026-10-19

References

https://github.com/FUNFACTOR1/pocket-android-xss-0click-cve
https://github.com/FUNFACTOR1/pocket-android-xss-0click-cve

Check your stack JSON