CVE-2026-18312 Readwise CVE debrief

Who should care

Defenders responsible for Readwise Reader for Android deployments, security teams, and IT personnel managing Android applications should assess exposure and prioritize patching to prevent exploitation of this stored XSS vulnerability. They should also review compensating controls for exposed systems, monitor for suspicious activity, and restrict input to Readwise Reader for Android to prevent malicious metadata. Additionally, they should verify and apply 7

Why it matters

CVE-2026-18312 is a stored XSS vulnerability in Readwise Reader for Android that allows an attacker to inject script content, enabling stored cross-site scripting. Defenders should prioritize verifying and patching Readwise Reader for Android to prevent exploitation.

• Verify and patch Readwise Reader for Android to prevent exploitation
• Monitor for suspicious activity in Readwise Reader for Android
• Restrict input to Readwise Reader for Android to prevent malicious metadata

Technical summary

The Readwise Reader for Android application constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. This allows an attacker to inject script content, enabling stored cross-site scripting (XSS). The vulnerability exists because the application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML without HTML or JavaScript context encoding. An attacker could supply a document containing malicious metadata that, once synchronized to an Android device and rendered in the Reader WebView, results in execution of injected script content.

Defensive priority

Defenders should prioritize verifying and patching Readwise Reader for Android to prevent exploitation of this stored XSS vulnerability.

Recommended defensive actions

• Verify and apply patches for Readwise Reader for Android
• Monitor for suspicious activity in Readwise Reader for Android
• Restrict input to Readwise Reader for Android to prevent malicious metadata
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 6.1 and MEDIUM severity. However, additional information on affected versions and remediation is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.