Security readout for executives and security teams
Plain-English summary
Pocket through version 8.33.0.0 may place untrusted external HTML inside the application. Embedded JavaScript could then use native bridge methods to change application state, creating serious confidentiality, integrity, and availability risk.
Executive priority
Treat as an immediate mobile application risk-assessment and containment priority. Focus first on devices accessing sensitive corporate data. Public exploit-oriented material increases urgency, but evidence of real-world exploitation and an authoritative fixed version is absent from the supplied sources.
Technical view
This is a CWE-79 cross-site scripting vulnerability in Pocket's “Save to Pocket” handling. The CVSS 4.0 assessment is 9.2 critical, with network reachability, low complexity, no privileges, and no user interaction stated; attack requirements are present. The vulnerable JavaScript context can reportedly invoke native bridge methods.
Likely exposure
Exposure is indicated for the Pocket Android package com.ideashower.readitlater.pro through 8.33.0.0. The supplied affected-version metadata also contains an ambiguous “0” entry and unknown default status, so inventories require careful version confirmation.
Exploitation context
A public third-party repository is tagged as technical and exploit material. However, the CVE is not listed as KEV in the supplied bundle, and no source provided establishes active exploitation in the wild.
Researcher notes
The core issue is a trust-boundary failure between externally sourced HTML, an embedded JavaScript environment, and privileged native bridge methods. The supplied record does not specify bridge methods, affected application states, patch commits, or a fixed release. Version metadata is internally unclear, limiting definitive exposure conclusions.
Mitigation direction
- Inventory Pocket Android installations and identify versions through 8.33.0.0.
- Remove or disable affected installations where operationally acceptable until authoritative remediation is confirmed.
- Restrict use of “Save to Pocket” with untrusted external content.
- Check Pocket or platform-owner guidance for a fixed version or supported mitigation.
- Prioritize managed mobile devices holding sensitive accounts or business data.
Validation and detection
- Confirm the installed Android package name and application version on managed devices.
- Verify affected installations are removed, disabled, or updated after authoritative guidance becomes available.
- Review mobile security telemetry for suspicious Pocket web-content or native-bridge activity.
- Confirm any replacement version falls outside the vendor-confirmed affected range.
- Monitor the CVE record and cited repository for clarified version and remediation information.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-82090 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——mitreVulnerability scoring details
Base CVSS 4.0 score
9.2CriticalVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/FUNFACTOR1/pocket-android-xss-0click-cveCVE reference, mitre · technical-description, third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.