Medium severityNVD Advisory· Published Sep 7, 2026

CVE-2026-78325

Description

Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and note data, and arbitrary invocation of native device APIs.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Standard Notes/appllm-create
Range: <3.201.24
Standard Notes/Standard Notes for Androidllm-create
Range: <3.201.24

Patches

Vulnerability mechanics

References

github.com/standardnotes/app/compare/%40standardnotes/desktop%403.201.24...%40standardnotes/desktop%403.201.25nvd
proton.me/security/security-advisoriesnvd

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000