EUVD-2026-72354
GHSA-3799-7g8h-9xh6
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
File imported locally (AV:L), no privileges needed (PR:N), user must trigger import (UI:R), scope changes as XSS bridges into native Android APIs (S:C), no availability impact described.
Primary rating from Vendor (Proton).
CVSS VectorVendor: Proton
Lifecycle Timeline
3DescriptionCVE.org
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and note data, and arbitrary invocation of native device APIs.
AnalysisAI
Cross-site scripting in Standard Notes for Android's Evernote (.enex) and Google Keep HTML note importers allows an attacker who socially engineers a victim into importing a crafted file to execute arbitrary JavaScript inside the app's WebView, stealing in-memory encryption keys and plaintext note data and invoking native Android device APIs. The impact is especially severe given Standard Notes' core value proposition is end-to-end encrypted note storage - key theft directly undermines that guarantee. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Victim must be running Standard Notes for Android version 3.201.24 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.9 is tempered primarily by UI:A (active user interaction - victim must deliberately trigger the import) and AV:L (file must reside on the device; attacker cannot remotely trigger import without social engineering). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Standard Notes for Android to version 3.201.25 or later, which contains the upstream fix per the GitHub diff at github.com/standardnotes/app/compare/%40standardnotes/desktop%403.201.24...%40standardnotes/desktop%403.201.25. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today