Unrated severityNVD Advisory· Published Nov 5, 2026

CVE-2026-106716

Description

ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. After a user opens the crafted link, the page can invoke getUserInfo, getCredentials, and initUser to obtain user metadata and an encrypted credential payload.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

ReelShort/ReelShortllm-create
Range: = 3.8.55
Siestazzz/myVulnDBllm-create
Range: = 3.8.55

Patches

Vulnerability mechanics

References

github.com/Siestazzz/myVulnDB/blob/main/Mobile/ReelShort_3.8.55/report.en.mdnvd
github.com/Siestazzz/myVulnDB/tree/main/Mobile/ReelShort_3.8.55nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000