CVE-2026-78325 in Standard Notes
Summary
by MITRE • 09/07/2026
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and note data, and arbitrary invocation of native device APIs.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified as CVE-2021-36795 represents a critical security flaw within the Standard Notes Android application, specifically affecting versions up through 3.201.24. This cross-site scripting (XSS) vulnerability resides in the note import functionality designed to process data from external sources such as Evernote and Google Keep. The core technical failure involves insufficient sanitization of user-supplied input during the parsing of .enex files, which are standard export formats for Evernote notes, and HTML files exported from Google Keep. When a victim imports a maliciously crafted file containing embedded JavaScript payloads, the application fails to properly escape or neutralize these scripts before rendering them within its internal web view components. This lack of input validation allows arbitrary code execution in the context of the application's privileged environment rather than restricting it to standard sandboxed browser contexts.
From an operational perspective, this vulnerability poses severe risks due to the sensitive nature of the data handled by Standard Notes. The platform is built around end-to-end encryption, relying on local storage for critical cryptographic material including private keys and session tokens. By executing arbitrary JavaScript within the application context, an attacker can bypass these security boundaries to exfiltrate encryption keys directly from memory or persistent storage. Once the encryption keys are compromised, all previously encrypted notes become decryptable by the attacker, effectively nullifying the primary privacy guarantee of the service. Furthermore, because the script executes in a privileged context, it gains access to native device APIs that are typically inaccessible to standard web content. This capability allows for arbitrary invocation of system functions, potentially leading further data theft, surveillance capabilities such as accessing contacts or location history, and manipulation of application behavior beyond simple note viewing.
This incident aligns with the Common Weakness Enumeration (CWE) category CWE-79 Improper Neutralization of Input During Web Page Generation known colloquially as Cross-site Scripting. More specifically, it reflects a failure in input validation where untrusted data is treated as executable code without adequate sanitization checks. In terms of offensive security frameworks, this vulnerability facilitates the MITRE ATT&CK technique T1059 Command and Scripting Interpreter via JavaScript execution within an application container. The attack vector relies on social engineering or compromised accounts to trick a user into importing a malicious file, classifying it under initial access vectors that exploit trust relationships rather than direct network exploitation.
Mitigation for this vulnerability requires immediate action by users of the affected software versions. The primary remediation is to upgrade Standard Notes for Android to version 3.201.25 or later, where developers have implemented stricter input sanitization and output encoding mechanisms specifically targeting imported note formats. Developers should also consider implementing Content Security Policy (CSP) headers within any web views used by the application to restrict script execution sources and prevent inline scripts from running unless explicitly whitelisted. Additionally, adopting a whitelist approach for allowed HTML tags and attributes during import processes can significantly reduce the attack surface. For organizations deploying this software, ensuring that update policies are enforced across all devices is essential to maintain data integrity and confidentiality against such client-side injection attacks.