CVE-2026-82090 in Pocket
Summary
by MITRE • 08/28/2026
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in Pocket versions prior to 8.33.0.0 represents a significant security flaw rooted in improper handling of user-supplied input within the mobile application's rendering engine. Specifically, the functionality labeled as Save to Pocket exhibits an insecure direct object reference or cross-site scripting vector by injecting external HTML directly into the Document Object Model without adequate sanitization or encoding. This architectural decision allows malicious actors to inject executable JavaScript payloads that are subsequently interpreted and executed by the browser component embedded within the application environment. The core technical failure lies in the lack of robust input validation mechanisms, which permits raw HTML content containing script tags to bypass security filters and become part of the active DOM tree.
From a technical perspective, this flaw facilitates Stored Cross-Site Scripting or Reflected Cross-Site Scripting depending on how the payload is delivered and persisted within the application's data flow. When an attacker crafts a malicious link or input field that triggers the Save to Pocket feature, the injected HTML is rendered by the native WebView component. Because modern mobile browsers operate with elevated privileges compared to standard web contexts in some implementations, particularly when interacting with local storage or app-specific APIs, this execution context can be leveraged for more severe impacts than traditional web-based XSS attacks. The presence of a JavaScript bridge further exacerbates the risk, as it provides an interface between the untrusted HTML content and the native application codebase.
The operational impact of this vulnerability extends beyond simple defacement or session hijacking in many scenarios due to the availability of native bridge methods accessible via JavaScript. These bridges typically expose sensitive device functionalities such as accessing local storage, reading clipboard data, interacting with contacts, or controlling network requests directly from the web view context. An attacker exploiting this flaw can manipulate the application state by invoking these native functions programmatically. This capability allows for unauthorized access to private user data stored locally on the device, manipulation of app preferences without user consent, and potentially facilitating further attacks such as phishing campaigns that appear legitimate because they originate from a trusted domain within the app's context.
This vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting in industry standards. Furthermore, the exploitation technique involving interaction with native components via JavaScript bridges maps closely to ATT&CK Mobile T1053 Executable and Native API Abuse or potentially T1204 User Execution if social engineering is used to trigger the save action. The ability to alter application state through these bridge methods also touches upon CWE-918 Server-Side Request Forgery implications if the native code makes network requests on behalf of the user without proper validation, although the primary classification remains within input validation and script injection failures.
Mitigation strategies must focus on implementing strict content security policies and rigorous output encoding for all data rendered in the WebView context. Developers should ensure that any HTML content derived from external sources is sanitized using a whitelist-based approach rather than relying solely on blacklist filters which are prone to bypasses. Additionally, the JavaScript bridge interface requires careful auditing; methods exposed to web views should be restricted to only those absolutely necessary and must include parameter validation to prevent arbitrary function calls or state manipulation. Upgrading to version 8.33.0.0 or later is critical as it addresses these input handling deficiencies by enforcing safer rendering practices and restricting the scope of accessible native APIs from untrusted script contexts.