CVE-2026-18312

Name of the Vulnerable Software and Affected Versions Readwise Reader for Android (affected versions not specified)

Description The application constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. Untrusted values are interpolated directly into URL strings and inserted into the Document Object Model (DOM) via innerHTML. Due to the lack of HTML or JavaScript context encoding, a crafted metadata value can break the intended URL structure to inject script content. This allows for stored cross-site scripting (XSS), where an attacker provides a document with malicious metadata that executes scripts when synchronized and rendered on an Android device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.