CVE-2026-18311

Name of the Vulnerable Software and Affected Versions Readwise Reader for Android versions prior to 8.7.3

Description Stored cross-site scripting (XSS) occurs due to missing HTML sanitization when processing imported document metadata. Specifically, attacker-controlled fields such as doc.author and doc.title are inserted into a WebView via innerHTML in the header rendering component. This allows arbitrary JavaScript to execute on synced devices when a malicious document is opened, potentially leading to the compromise of stored documents, credentials, and session tokens.

Recommendations Update Readwise Reader for Android to the latest version. Avoid importing documents from untrusted sources into applications that render content in a WebView.