CVE-2026-116072 Docile-Alligator CVE debrief

Who should care

Defenders responsible for managing Android devices with the Infinity for Reddit app installed should be aware of this vulnerability. Additionally, Reddit users who utilize the Infinity for Reddit app may want to monitor their account activity for suspicious behavior.

Why it matters

The Infinity for Reddit app through version 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account. Defenders should prioritize verifying the version of the app installed on managed devices and consider implementing compensating controls.

• Defenders should verify the version of Infinity for Reddit installed on managed devices to prevent potential unauthorized account access.
• Implementing compensating controls such as multi-factor authentication for Reddit accounts may be advisable to mitigate the impact of this vulnerability.
• Monitoring for suspicious account activity may help detect potential exploitation of this vulnerability.
• Updating to a version beyond 8.3.4, if available, may prevent exploitation of this vulnerability.

Technical summary

The Infinity for Reddit app through version 8.3.4 contains a login cross-site request forgery vulnerability due to a hardcoded OAuth state value in the LoginChromeCustomTabActivity redirect handler. This allows attackers to log victims into an attacker-controlled account, potentially leading to unauthorized access to the victim's posts, messages, and browsing history. Defenders should prioritize verifying the version of Infinity for Reddit installed on managed Android devices and consider updating to a version beyond 8.3.4 if available. Additionally, monitoring for suspicious account activity and implementing compensating controls such as multi-factor authentication for Reddit accounts may be advisable. The CVE

Defensive priority

Defenders should prioritize verifying the version of Infinity for Reddit installed on managed Android devices and consider updating to a version beyond 8.3.4 if available. Additionally, monitoring for suspicious account activity and implementing compensating controls such as multi-factor authentication for Reddit accounts may be advisable.

Recommended defensive actions

• Verify the version of Infinity for Reddit installed on managed Android devices.
• Consider updating to a version beyond 8.3.4 if available.
• Monitor for suspicious account activity.
• Implement compensating controls such as multi-factor authentication for Reddit accounts.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The evidence for this vulnerability comes from the Infinity for Reddit GitHub repository and a Vulncheck advisory. The CVE record and NVD entry provide additional context, but no further details on exploitation or impact are available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.