Online Shopping App
Monthly
Cleartext storage of personally identifiable information in Meesho Online Shopping App (Android, versions through 20260607) exposes user_id, phone number, email address, and name in the com.meesho.supply component without encryption. Exploitation requires physical access to the device and a degree of local privilege, making this a low-severity, localized threat rather than a remote or mass-exploitation risk. A proof-of-concept is publicly available via GitHub and Google Drive, though no active exploitation has been confirmed by CISA KEV.
Cleartext storage of personally identifiable information in Meesho Online Shopping App (Android, versions through 20260607) exposes user_id, phone number, email address, and name in the com.meesho.supply component without encryption. Exploitation requires physical access to the device and a degree of local privilege, making this a low-severity, localized threat rather than a remote or mass-exploitation risk. A proof-of-concept is publicly available via GitHub and Google Drive, though no active exploitation has been confirmed by CISA KEV.