{"id":"CVE-2026-106716","kind":"vulnerability","aliases":["CVE-2026-106716"],"related":[],"title":"ReelShort Android app: crafted deep link leaks user info and credentials","description":"ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. After a user opens the crafted link, the page can invoke getUserInfo, getCredentials, and initUser to obtain user metadata and an encrypted credential payload.","summary":"ReelShort for Android 3.8.55 loads an attacker-controlled activityUrl from the cmsvictor://open deep link into a WebView that exposes the Android and Offerwall JavaScript bridges without checking the page origin. Once a user opens the crafted link, the page can call getUserInfo, getCredentials and initUser to get user metadata and an encrypted credential payload. The sources do not say whether that payload can be decrypted.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ReelShort","fixed":[],"affected":"3.8.55","ecosystem":"android"}],"ecosystems":[],"tags":["android","deep-link","mobile","other","reelshort","webview"],"not_affected_if":["ios","no-deep-link-opened","other-app-versions"],"how_to_check":"Check the installed ReelShort version (Android Settings > Apps > ReelShort, or the Play Store listing). Version 3.8.55 is the one named in the CVE description. No fixed version is published in the sources I read.","fix":null,"status":"open","published_at":"2026-11-05T15:17:17+00:00","first_seen_at":"2026-11-05T15:39:21+00:00","triaged_at":"2026-11-05T15:41:04+00:00","updated_at":"2026-11-05T15:42:23+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-05T15:41:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ReelShort Android app: crafted deep link leaks user info and credentials","impact":"medium","summary":"ReelShort for Android 3.8.55 opens a web page from a cmsvictor:// deep link inside a WebView that exposes app JavaScript bridges without checking the page's origin. A malicious link can make that page call getUserInfo, getCredentials and initUser to obtain user metadata and an encrypted credential payload.","audience":"everyone","category":"other","nicknames":[],"who_cares":["reelshort","android","mobile"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker page reads user metadata and encrypted credential payload from the app","analyst_note":"Confirm the fixed version and whether the encrypted credential payload is recoverable, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-106716 and the vendor's release notes.","how_to_check":"- Check the installed ReelShort for Android version in the app's settings or Play Store listing; version `3.8.55` is the affected one per the NVD description.\n- unknown for other checks: the sources do not say.","plain_action":"If you use the ReelShort app on Android, update it to the newest version from the Play Store; the sources do not name a fixed version.","needs_analyst":true,"not_affected_if":["other-app-versions","ios","no-deep-link-opened"],"who_is_affected":"Users of ReelShort for Android version 3.8.55 who open a crafted cmsvictor:// link. The sources describe the WebView bridge exposure in the app itself, not any server-side component, so teams that only run backend services are not described as affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00074,"input_tokens":4259,"output_tokens":629,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether the encrypted credential payload is recoverable, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-106716 and the vendor's release notes.","search":"'-106716':14A,17A '-2026':13A,16A '3.8.55':30B,97C 'activityurl':36B,103C 'android':2A,19B,29B,48B,95C,116C 'app':3A 'attack':34B,101C 'attacker-control':33B,100C 'bridg':52B,120C 'call':68B 'check':54B 'control':35B,102C 'craft':4A,63B,131C 'credenti':11A,80B,148C 'cve':12A,15A 'decrypt':92B 'deep':5A,21B,40B,108C 'deep-link':20B 'encrypt':79B,147C 'expos':46B,114C 'get':74B 'getcredenti':70B,138C 'getuserinfo':69B,137C 'info':9A 'initus':72B,140C 'invok':136C 'javascript':51B,119C 'leak':7A 'link':6A,22B,41B,64B,109C,132C 'load':31B,98C 'metadata':76B,144C 'mobil':23B 'obtain':142C 'offerwal':50B,118C 'open':39B,61B,107C,129C 'origin':57B,125C 'page':56B,66B,124C,134C 'payload':81B,89B,149C 'reelshort':1A,18A,25B,27B,93C 'say':86B 'sourc':83B 'suppli':104C 'user':8A,60B,75B,128C,143C 'valid':122C 'version':96C 'webview':26B,44B,112C 'whether':87B 'without':53B,121C","nicknames":[],"mitigations":[],"who_affected":"Anyone with ReelShort for Android 3.8.55 installed who opens a crafted cmsvictor:// link, for example from a web page, message or another app. Other versions are not named in the CVE; they are unconfirmed either way.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you use the ReelShort app on Android, update it to the newest version from the Play Store; the sources do not name a fixed version.","pkeys":["reelshort"],"ptokens":["reelshort"],"labels":["android","deeplink","high","mobile","other","reelshort","webview"],"campaign_type":null,"first_public_at":"2026-11-05T15:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106716","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106716","severity":null,"published_at":"2026-11-05T15:17:17+00:00","modified_at":"2026-11-05T15:17:17+00:00","first_seen_at":"2026-11-05T15:39:21+00:00","fetched_at":"2026-11-05T15:39:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-106716:1792","url":"https://cve.imfht.com/detail/CVE-2026-106716","severity":null,"published_at":"2026-11-05T15:42:23+00:00","modified_at":"2026-11-05T15:42:23+00:00","first_seen_at":"2026-11-05T15:42:23+00:00","fetched_at":"2026-11-05T15:42:23+00:00","note":"Only the CVE List V5 description was readable (via the imfht mirror). The NVD page returned empty, and I found no ReelShort vendor advisory or release notes. Fix version unknown. Whether the encrypted credential payload can be recovered is not stated anywhere I could read. Nothing marked verified. No public PoC and no exploitation reported. To settle the fix, check the Play Store changelog for versions after 3.8.55.","cites":["https://cve.imfht.com/detail/CVE-2026-106716"]}],"documents":[{"id":77389,"url":"https://cve.imfht.com/detail/CVE-2026-106716","title":"CVE-2026-106716 (mirror of CVE List V5 description)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}