---
id: "CVE-2026-106716"
kind: "vulnerability"
aliases: ["CVE-2026-106716"]
title: "ReelShort Android app: crafted deep link leaks user info and credentials"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "ReelShort", "fixed": [], "affected": "3.8.55", "ecosystem": "android"}]
ecosystems: []
tags: ["android", "deep-link", "mobile", "other", "reelshort", "webview"]
not_affected_if: ["ios", "no-deep-link-opened", "other-app-versions"]
published_at: "2026-11-05T15:17:17+00:00"
first_seen_at: "2026-11-05T15:39:21+00:00"
updated_at: "2026-11-05T15:42:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106716", "first_seen_at": "2026-11-05T15:39:21+00:00"}, {"source": "analyst", "url": "https://cve.imfht.com/detail/CVE-2026-106716", "first_seen_at": "2026-11-05T15:42:23+00:00", "cites": ["https://cve.imfht.com/detail/CVE-2026-106716"]}]
exploit_sources: []
---

# ReelShort Android app: crafted deep link leaks user info and credentials

ReelShort for Android 3.8.55 loads an attacker-controlled activityUrl from the cmsvictor://open deep link into a WebView that exposes the Android and Offerwall JavaScript bridges without checking the page origin. Once a user opens the crafted link, the page can call getUserInfo, getCredentials and initUser to get user metadata and an encrypted credential payload. The sources do not say whether that payload can be decrypted.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- android:ReelShort affected 3.8.55 fixed no fixed version listed

## How to check

Check the installed ReelShort version (Android Settings > Apps > ReelShort, or the Play Store listing). Version 3.8.55 is the one named in the CVE description. No fixed version is published in the sources I read.

## Timeline

- 2026-11-05T15:39:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106716
- 2026-11-05T15:42:23+00:00 analyst https://cve.imfht.com/detail/CVE-2026-106716 — Only the CVE List V5 description was readable (via the imfht mirror). The NVD page returned empty, and I found no ReelShort vendor advisory or release notes. Fix version unknown. Whether the encrypted credential payload can be recovered is not stated anywhere I could read. Nothing marked verified. No public PoC and no exploitation reported. To settle the fix, check the Play Store changelog for versions after 3.8.55.

## Documents

- [describes] CVE-2026-106716 (mirror of CVE List V5 description) https://cve.imfht.com/detail/CVE-2026-106716

## From the sources

ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. After a user opens the crafted link, the page can invoke getUserInfo, getCredentials, and initUser to obtain user metadata and an encrypted credential payload.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_