Readwise Reader EUVD-2026-87230

Exploitation requires (1) the victim to be running an affected Readwise Reader for Android version (8.7.2 through 8.10.1); (2) the attacker to get a crafted document containing malicious metadata into the victim's library so it synchronizes to the device; and (3) the victim to actually open/render that document in the Reader WebView (UI:R), triggering the innerHTML URL interpolation. Limiting factors: no attacker privileges on the victim device are needed (PR:N), but the stored/content-delivery nature plus mandatory victim rendering narrows practical reach; impact is confined to the app's WebView context (C:L/I:L), not the whole device.

This is a genuine but moderate-severity stored XSS (CWE-79) in the Readwise Reader Android app, not a high-priority emergency. The NVD CVSS 3.1 vector (6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is internally consistent with the description: exploitation is unauthenticated from the attacker's side (they only need to author a malicious document) but requires victim interaction (UI:R) - the poisoned document must be synchronized to the victim's device and then rendered in the Reader WebView. All exploitation-likelihood signals point LOW: SSVC records Exploitation=none, Automatable=no, and only Partial technical impact, and there is no EPSS score, no CISA KEV listing, and no public proof-of-concept identified at time of analysis. Impact is correctly bounded to C:L/I:L/A:N - script runs inside the app WebView (session/data disclosure and limited manipulation), not full device compromise. Note one nuance to verify: AV:N is reasonable because the malicious content is delivered over the network via document sync, but this is really a content-injection/stored vector requiring the victim to add and open the attacker's document, so real-world reach is narrower than a typical drive-by network XSS. Overall: a legitimate defect worth patching in the affected 8.7.2-8.10.1 range, but low urgency given no exploitation evidence and the interaction requirement.

An attacker crafts a document whose metadata (e.g., title/author fields) contains a payload that breaks out of the URL string interpolated into innerHTML. The victim saves or receives this document, it syncs to their Android device, and when they open it in the Reader WebView the injected script executes in the app context, enabling stored XSS to read session data or manipulate the rendered view. No public exploit code is identified, and victim interaction (rendering the document) is required.