Monthly
Cross-site scripting in Mozilla's Pocket (read-it-later service) through version 8.33.0.0 lets attacker-controlled external HTML execute in the application DOM when a user's "Save to Pocket" action ingests a malicious page, and the injected JavaScript can then reach native bridge methods to manipulate application state. Publicly available exploit code exists, and the referenced proof-of-concept describes a zero-click Android chain, so the practical impact reaches well beyond a cosmetic script injection. No CISA KEV listing means there is no public exploit identified as actively exploited, but the combination of a working POC and native-bridge reach makes this high priority.
Cross-site scripting in Mozilla's Pocket (read-it-later service) through version 8.33.0.0 lets attacker-controlled external HTML execute in the application DOM when a user's "Save to Pocket" action ingests a malicious page, and the injected JavaScript can then reach native bridge methods to manipulate application state. Publicly available exploit code exists, and the referenced proof-of-concept describes a zero-click Android chain, so the practical impact reaches well beyond a cosmetic script injection. No CISA KEV listing means there is no public exploit identified as actively exploited, but the combination of a working POC and native-bridge reach makes this high priority.