CVE-2026-106716

ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. After a user opens the crafted link, the page can invoke getUserInfo, getCredentials, and initUser to obtain user metadata and an encrypted credential payload.

EPSS 0.15%Not in KEVNVD: Received

Last updated: 2026-11-05 15:17 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

No CVSS score has been published for CVE-2026-106716 yet.

Details

CVE ID: CVE-2026-106716
Status: Received
Assigner (CNA): mitre
Published: Nov 5, 2026
Last modified: 2026-11-05 15:17 UTC

Sources

NVD
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:27 UTC.