CVE-2026-82090CWE-79cross-site-scripting

CVE-2026-82090

published August 28, 2026

CVSS
9.2
EPSS
0%
Percentile
36.9
In the wild
Unconfirmed
What it is

Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM.  JavaScript code can alter the application state via native bridge methods.

The record
Technical detail
CVSS
9.2 · NONE
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00436 · 36.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-28T09:16Z
References (2)
https://github.com/FUNFACTOR1/pocket-android-xss-0click-cve · [email protected]https://github.com/FUNFACTOR1/pocket-android-xss-0click-cve · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 28 AUG 03:36Z
    Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM
    cvelistv5