Standard Notes
Monthly
Cross-site scripting in Standard Notes for Android's Evernote (.enex) and Google Keep HTML note importers allows an attacker who socially engineers a victim into importing a crafted file to execute arbitrary JavaScript inside the app's WebView, stealing in-memory encryption keys and plaintext note data and invoking native Android device APIs. The impact is especially severe given Standard Notes' core value proposition is end-to-end encrypted note storage - key theft directly undermines that guarantee. Proof-of-concept exploit code exists per CVSS 4.0 E:P supplemental metric; no active exploitation (CISA KEV) identified at time of analysis.
Cross-site scripting in Standard Notes for Android's Evernote (.enex) and Google Keep HTML note importers allows an attacker who socially engineers a victim into importing a crafted file to execute arbitrary JavaScript inside the app's WebView, stealing in-memory encryption keys and plaintext note data and invoking native Android device APIs. The impact is especially severe given Standard Notes' core value proposition is end-to-end encrypted note storage - key theft directly undermines that guarantee. Proof-of-concept exploit code exists per CVSS 4.0 E:P supplemental metric; no active exploitation (CISA KEV) identified at time of analysis.