HCL Verse Android CVE-2026-21768

Exploitation requires that the victim is using the HCL Verse for Android application and actively engages with the rich text email composition feature (AV:L/UI:R). A specific precondition is the use of compose-rich-editor v1.0.0-rc14 as the rendering library, which is bundled with the affected app. The attacker must introduce malicious HTML content into the composition context - this could be through clipboard paste, an in-app content insertion mechanism, or maliciously crafted email content rendered in the compose view. Attack complexity is rated High (AC:H), meaning reliable exploitation is not straightforward and likely requires a specific triggering condition within the composition flow. Exploitation is limited by: (1) physical or logical local access to the device context being required (AV:L), (2) mandatory user interaction with the crafted content, and (3) the high attack complexity reducing reliability. Remote-only attackers without a delivery vector into the composition UI cannot exploit this directly.

The official CVSS 3.1 score of 6.3 (Medium) with vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N presents a moderate aggregate risk. The local attack vector (AV:L) and high attack complexity (AC:H) significantly constrain exploitability - an attacker cannot directly exploit this over a network without additional delivery steps, and exploitation conditions are non-trivial. User interaction (UI:R) is required, meaning a victim must actively engage with malicious content in the composition view. Despite these limiting factors, the C:H and I:H impact ratings indicate that successful exploitation yields significant compromise of data confidentiality and integrity within the app's sandbox. No EPSS data was provided and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at time of analysis. The 'Information Disclosure' tag aligns with the C:H rating. The wildcard CPE (*) for affected versions suggests all current Verse for Android releases may be impacted. Overall real-world risk is moderate: the attack complexity and local vector reduce opportunistic exploitation likelihood, but the impact ceiling for a targeted victim is high.

An attacker crafts a malicious HTML payload - for example, an inline script or a data-exfiltration iframe - and delivers it to a target user, perhaps embedded in a forwarded email or a shared document link that the user pastes into HCL Verse for Android's rich text composition window. When the victim interacts with the maliciously crafted content within the editor, the compose-rich-editor library fails to strip or escape the dangerous HTML, causing it to execute within the app's WebView context. No public proof-of-concept code has been identified at time of analysis, but the attack complexity is rated High, implying reliable triggering requires attacker-controlled preconditions beyond simply sending content.