VYPR

ReelShort

by ReelShort

CVEs (1)

  • CVE-2026-106716Nov 5, 2026
    risk 0.00cvss —epss —

    ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. After a user opens the crafted link, the page…