Pocket EUVD-2026-67403

Exploitation requires that attacker-controlled external HTML reach the "Save to Pocket" ingestion path and be rendered in the client, where the DOM injection then calls native bridge methods to affect app state - that content-ingestion step is the concrete prerequisite, reflected in the CVSS 4.0 AT:P (attack requirements present) metric. No authentication is required (PR:N) and the vector is network-based with no user interaction flagged (UI:N); the referenced POC characterizes it as zero-click on Android, indicating the save/render can be triggered without an explicit deliberate user action. Limiting factors: the target must actually ingest the malicious content via Pocket, the demonstrated exploit is Android-specific, and only versions through 8.33.0.0 are affected.

The signals are mostly consistent toward high priority. The vendor-supplied CVSS 4.0 base score is 9.2 (Critical) with AV:N/AC:L/PR:N/UI:N and high vulnerable-system confidentiality, integrity, and availability impact, indicating remote, unauthenticated, low-complexity exploitation. The one moderating metric is AT:P (attack requirements present) - exploitation is not fully unconditional; it depends on the victim saving or rendering attacker-controlled content. A public POC exists and is characterized as a zero-click Android attack, which raises real-world exploitability, but there is no CISA KEV entry and no EPSS value provided, so widespread active exploitation is not confirmed. Given a POC plus native-bridge reach, defenders should treat this as urgent and not wait for KEV confirmation; even a mid-sized operator with a modest security team should prioritize the client update rather than deferring on the absence of an EPSS figure. The main uncertainty is the true attack requirement (AT:P) - verify with Mozilla whether default configurations are exploitable without atypical user steps.

An attacker publishes a web page containing crafted HTML/JavaScript and lures a Pocket user to save it (or, per the POC, triggers ingestion with no click). When Pocket renders the saved content, the external HTML executes in the app DOM and the script invokes native bridge methods to alter application state. Publicly available exploit code demonstrating an Android zero-click chain lowers the skill barrier to reproduce this.