CVE-2026-106716 in ReelShort
Summary
by MITRE • 11/05/2026
ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. After a user opens the crafted link, the page can invoke getUserInfo, getCredentials, and initUser to obtain user metadata and an encrypted credential payload.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in ReelShort for Android version 3.8.55 represents a critical failure in input validation and secure coding practices within its deep link handling mechanism. The application utilizes the cmsvictor://open URI scheme to facilitate navigation between external content sources and internal application components. When this specific deep link is invoked, the application loads the provided activityUrl parameter directly into an embedded WebView component without performing any origin verification or sanitization checks. This architectural flaw allows a malicious actor to supply arbitrary URLs that are rendered within the context of the ReelShort application environment, effectively bypassing standard browser security boundaries and granting the loaded content elevated privileges associated with the app's native interfaces.
The core technical flaw lies in the exposure of Android JavaScript bridges without corresponding origin validation. Modern hybrid applications often expose Java methods to JavaScript code running inside WebViews through specific bridge mechanisms such as addJavascriptInterface or similar implementations. In this instance, the WebView exposes critical interfaces including getUserInfo, getCredentials, and initUser. Because the application does not validate that the content being loaded originates from a trusted domain, any webpage hosted by an attacker can execute these JavaScript functions. This lack of origin checking transforms the WebView into a conduit for privilege escalation, allowing untrusted web content to interact directly with sensitive native Android APIs as if it were part of the legitimate application codebase.
The operational impact of this vulnerability is severe, leading to unauthorized access to user data and potential account compromise. By invoking the getUserInfo function, an attacker can retrieve personal metadata associated with the victim's ReelShort account, such as usernames, email addresses, or device identifiers. More critically, the ability to call getCredentials allows the extraction of encrypted credential payloads. While these credentials are encrypted, their exposure provides a significant attack surface for offline cracking attempts or further exploitation if encryption keys can be derived from other application components. Additionally, the initUser function may allow an attacker to manipulate user session states or trigger initialization routines that could lead to further logical flaws within the app's authentication flow.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and CWE-79 Cross-site Scripting in terms of its mechanism, but more specifically maps to CWE-200 Exposure of Sensitive Information to an Unauthorized Actor due to the leakage of user metadata and credentials. From a threat modeling perspective using the MITRE ATT&CK framework for mobile platforms, this behavior corresponds to T1537.001 Component Software: Deep Linking, where attackers leverage deep links to execute malicious actions within trusted applications. It also relates to T1218 System Binary Proxy Execution in the context of hijacking application components through URI schemes.
Mitigation strategies must focus on strict input validation and secure interface exposure. Developers should implement rigorous origin checking for all URLs loaded into WebViews, ensuring that only whitelisted domains are permitted to execute JavaScript bridges. The use of addJavascriptInterface should be restricted to methods that do not expose sensitive data or system capabilities unless absolutely necessary, and even then, they must be protected by robust permission checks. Furthermore, implementing Content Security Policy headers within the WebView can help restrict script execution sources. Regular security audits focusing on deep link handling and JavaScript bridge configurations are essential to prevent similar vulnerabilities in future releases of mobile applications that rely on hybrid web technologies.