EUVD-2026-67403
GHSA-xfmw-9xm9-7q4j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated DOM XSS but requires attacker content to be ingested (AC:H, UI:R); native bridge reach beyond the WebView justifies S:C with high C/I, no clear availability loss.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods.
AnalysisAI
Cross-site scripting in Mozilla's Pocket (read-it-later service) through version 8.33.0.0 lets attacker-controlled external HTML execute in the application DOM when a user's "Save to Pocket" action ingests a malicious page, and the injected JavaScript can then reach native bridge methods to manipulate application state. Publicly available exploit code exists, and the referenced proof-of-concept describes a zero-click Android chain, so the practical impact reaches well beyond a cosmetic script injection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that attacker-controlled external HTML reach the "Save to Pocket" ingestion path and be rendered in the client, where the DOM injection then calls native bridge methods to affect app state - that content-ingestion step is the concrete prerequisite, reflected in the CVSS 4.0 AT:P (attack requirements present) metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mostly consistent toward high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Pocket client to a release later than 8.33.0.0 once Mozilla publishes a fixed build; the input data does not include an exact patched version number, so confirm the first-fixed version directly with the vendor before rollout (do not rely on an assumed version). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, notify all Pocket users to refrain from saving content from untrusted sources and consult Mozilla's security advisory for any interim workarounds; immediately audit how many users have Pocket enabled and which business workflows depend on it. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today