REELSHORT · CVE-2026-106716 · Other
NO FIX YET
ReelShort for Android 3.8.55 loads an attacker-controlled activityUrl from the cmsvictor://open deep link into a WebView that exposes the Android and Offerwall JavaScript bridges without checking the page origin. Once a user opens the crafted link, the page can call getUserInfo, getCredentials and initUser to get user metadata and an encrypted credential payload. The sources do not say whether that payload can be decrypted.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Anyone with ReelShort for Android 3.8.55 installed who opens a crafted cmsvictor:// link, for example from a web page, message or another app. Other versions are not named in the CVE; they are unconfirmed either way.
Not affected if ios, no-deep-link-opened, other-app-versions
Who cares android, deep-link, mobile, reelshort, webview
3.8.55 is the one named in the CVE descriptionNo fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. After a user opens the crafted link, the page can invoke getUserInfo, getCredentials, and initUser to obtain user metadata and an encrypted credential payload.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.