XSS 0-Click / 0-Day Vulnerability Report

Cross-Site Scripting (0-Click) Leading to JavaScript Bridge Abuse in Pocket Android & iOS — CVSS 9.2 CRITICAL

CVE-2026-82090 — Published by MITRE Corporation (2026-08-28)

Author: Ing. Zampier Zago (FUNFACTOR1) Division: Section 1 — Department of Cyber Security, PS 1978 Limited Contact: [email protected] Web: www.ps1978ltd.it Classification: Security Vulnerability Analysis — CVE-2026-82090

Dual-Use Content Disclaimer: This repository contains a vulnerability analysis and a Proof of Concept (PoC) for an End-of-Life (EOL) product. The information and code provided are strictly for educational purposes, defensive analysis, and official CVE documentation. The author holds no responsibility for any misuse of this information.

https://github.com/user-attachments/assets/e2b0aa46-df64-452b-afbf-fa31dd8c650d

1. Executive Summary

A DOM-based Cross-Site Scripting (XSS) vulnerability has been confirmed in Pocket Android version 8.33.0.0 (package com.ideashower.readitlater.pro), the final release shipped by Mozilla / Read It Later, Inc. before service termination in July 2025. The vulnerability allows an attacker to inject and execute arbitrary JavaScript in the application's WebView without any user interaction beyond a single "Save to Pocket" action — a 0-click exploit post-delivery.

The root cause is the unsanitized injection of externally-sourced HTML content directly into the DOM via jQuery's .html() method ($(document.body).html(content)), in the asset-bundled file assets/html/j/articleview-mobile.js (lines 95–99). Content is fetched and rendered automatically in the background by com.pocket.sdk.offline.DownloadingService with no user interaction required.

The application also exposes a native Java-to-JavaScript bridge (PocketAndroidArticleInterface), registered via addJavascriptInterface and confirmed in classes2.dex, callable by JavaScript executing within the WebView.

Vendor disclosure record: The XSS was formally reported to Mozilla Security on 2024-07-10 with CWE-79 classification and full technical detail. Mozilla acknowledged receipt on 2024-07-11 and explicitly declined to remediate, declaring Pocket out of scope. Mozilla subsequently released v8.33.0.0 in 2025 with the vulnerable code entirely unchanged. Forensic analysis of v8.33.0.0 confirms the identical vulnerable call at lines 95–99 of articleview-mobile.js.

Lineage: The same identical line — $(document.body).html(content), in a file of the same name articleview-mobile.js — is present in the iOS counterpart bundle ReadItLaterPro.app (Pocket iOS v4.5.2), dating to the era immediately preceding the April 17, 2012 rebrand of Read It Later as Pocket. The CVE covers all versions from v0 through v8.33.0.0 — the defect has been continuously shipped, unmodified, across the product's entire 18-year lifespan (see §7). Forensic code-level confirmation via the oldest available bundle (iOS v4.5.2) dates the identical sink to at least 2012.

No patch is available. The product is abandoned. All installed instances remain permanently vulnerable.

2. Affected Product

• Product name: Pocket — Save. Read. Grow. (Android)
• Package name: com.ideashower.readitlater.pro
• Build version: 8.33.0.0 (final release before service sunset)
• APK analyzed: com.ideashower.readitlater.pro_8.33.0.0.apk
• Vendor: Read It Later, Inc. / Mozilla Corporation
• Google Play: Unpublished from Google Play Store on 2025-05-21. Listing page may still be reachable at https://play.google.com/store/apps/details?id=com.ideashower.readitlater.pro but the app is no longer available for download.
• Service status: TERMINATED (2025-07-08). The application remains installed on millions of devices with no forced uninstall, kill-switch, or security update deployed. Video evidence (2026-01-02) confirms full operation — including paywall bypass and background services — months after official shutdown.

3. Vulnerability Details — Issue #1: 0-Click XSS via WebView

3.1 Vulnerability Classification

3.2 Vulnerable Component

File: assets/html/j/articleview-mobile.js Lines 95–99:

// article content was retrieved
loadCallback : function(content)
{
    // TODO : 3.0 : If file was missing, handle that correctly
    $(document.body).html(content);

Root cause: Externally-sourced HTML is passed directly to jQuery 3.4.1's .html() method with no sanitization. jQuery 3.4.1 executes embedded <script> tags and inline event handlers (onerror, onload). No call to DOMPurify, sanitize(), escapeHtml(), or equivalent exists anywhere in the 1,836-line file. The content variable originates from the Java layer without JS-side filtering.

The // TODO : 3.0 : If file was missing, handle that correctly comment immediately preceding the vulnerable call demonstrates the code was never production-hardened. This comment was present in every version of the app through the final release v8.33.0.0.

3.3 JavaScript Bridge Evidence

File: assets/html/j/articleview-mobile.js, lines 11–14:

// Android comm object
if (typeof PocketAndroidArticleInterface == 'undefined')
    PocketAndroidArticleInterface = false;

isAndroid = !!PocketAndroidArticleInterface;

Confirmed via DEX string analysis (classes2.dex):

PocketAndroidArticleInterface
setJavaScriptEnabled
addJavascriptInterface

Confirmed bridge methods from JS call sites: onReady(), onError(), onScrollChanged(), setFrozen(), placePageBlockers(), toggleFullscreen(), setViewType(), scrollToPosition(), onTextSearch(), onRequestedHighlightPatch(), updatePageSwipingDisabledAreas(), getHorizontalMargin(), getMaxMediaHeight(), isConnected().

3.4 Background Sync Service

AndroidManifest.xml confirms:

<service
    android:name="com.pocket.sdk.offline.DownloadingService"
    android:permission="android.permission.FOREGROUND_SERVICE_DATA_SYNC">

With BOOT_COMPLETED receiver registered. The service fetches and renders article content automatically on device boot and network availability, triggering loadCallback in a hidden WebView without any user interaction.

3.5 Attack Chain

Phase 1 — Content Injection [CONFIRMED]
  Attacker hosts page with XSS payload.
  Victim saves URL via "Save to Pocket".
  Malicious HTML stored in local Pocket database.

Phase 2 — Zero-Click Background Sync [CONFIRMED]
  DownloadingService auto-starts on boot (BOOT_COMPLETED).
  Fetches article content silently, no user interaction.

Phase 3 — Automatic WebView Rendering [CONFIRMED]
  Pagination engine (updatePaging) triggers hidden WebView render.
  No user opens the article.

Phase 4 — JavaScript Execution [CONFIRMED]
  loadCallback calls $(document.body).html(content).
  jQuery 3.4.1 executes embedded scripts and event handlers.

Phase 5 — Native Bridge Reachability [PARTIAL]
  Bridge object PocketAndroidArticleInterface is reachable from
  the XSS execution context (confirmed via classes2.dex string
  analysis and JS call-site inventory). Full native method
  surface and downstream impact pending complete JADX
  decompilation.

4. Proof of Concept

<!DOCTYPE html>
<html>
<body>

</body>
</html>

Steps to reproduce:

1. Host the above page at a public URL.
2. Victim saves the URL to Pocket (one click — "Save to Pocket").
3. No further user interaction required.
4. DownloadingService fetches content automatically.
5. Pagination engine renders article in hidden WebView.
6. loadCallback → $(document.body).html(content) → payload fires.
7. Attacker server receives exfiltrated data silently.

Note on platform scope of the PoC: The executable proof of concept above targets the Android build, which is the 0-click case (background DownloadingService). The iOS counterpart (Pocket iOS v4.5.2 / ReadItLaterPro.app) shares the identical vulnerable loadCallback() sink in a file of the same name, but reaches native code through a different bridge mechanism (the x-ril-cmd: URL-scheme intercepted by the UIWebView delegate) and degrades to a 1-click case (the user must open a saved article). The iOS evidence is established by static analysis of the shipped app bundle and is documented in full in iOS_forensic_analysis_v4.5.2.md in this repository. No separate executable iOS PoC is published; the shared-codebase analysis demonstrates the equivalence of the sink across both platforms.

5. CVSS v4.0 Vector Decomposition

Full vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Base Score: 9.2 — CRITICAL

6. Vendor Communication History

All dates verified against original email evidence (POCKET_MAIL.pdf, POCKET_MAIL1.pdf, CRONO2.pdf).

7. Lineage — 18 Years of the Same Vulnerable Code (2007 → 2025)

The CVE record confirms all versions from v0 through v8.33.0.0 as affected. The defect is not a regression — it is the original architecture of the article-rendering pipeline, present since Read It Later launched as a Firefox extension in 2007, carried into the mobile apps (Android from 2011, iOS earlier), and shipped unchanged through the final 2025 Android release. Forensic code-level confirmation of the identical vulnerable sink extends to 2012 via the oldest available bundle (iOS v4.5.2).

7.1 iOS Counterpart — Pocket iOS v4.5.2 (ReadItLaterPro.app)

The iOS application bundle is named ReadItLaterPro.app — the pre-rebrand product name used by Read It Later, Inc. before the company publicly renamed the app to Pocket on 17 April 2012. The bundle targets iOS 5.0+, placing the codebase in the 2011–early 2012 timeframe.

Forensic analysis of this iOS bundle confirms a character-for-character identical vulnerable pattern in a file with the same name as the Android version. The complete iOS forensic analysis — vulnerable sink, content pipeline, native bridge, telemetry inventory, and evidence references — is published in this repository as iOS_forensic_analysis_v4.5.2.md.

File: manifest/cache/j/articleview-mobile.js (iOS) — same filename as assets/html/j/articleview-mobile.js (Android)

Lines 97–107 (iOS):

// article content was retrieved
loadCallback : function(content)
{
    // TODO : 3.0 : If file was missing, handle that correctly

    $(document.body).html(content);          // ← IDENTICAL TO ANDROID

    // Add empty content to bottom in case an image is at bottom.
    $(document.body).append($('<br>&nbsp;'))

    this.onArticleReady();
},

The same // TODO : 3.0 comment is present in both platforms — the same exact placeholder, never followed up on, across ~13 years.

7.2 Shared Codebase Confirmed

The iOS bundle contains explicit platform-branching logic that proves Read It Later, Inc. / Mozilla shipped a single shared JavaScript codebase to both platforms:

var isAndroid;
if (typeof ReadItLaterJSMethods == 'undefined')
    ReadItLaterJSMethods = false;
isAndroid = !!ReadItLaterJSMethods;

When isAndroid === false the iOS bridge path executes; when true the Android path executes. Both paths converge on the same vulnerable loadCallback() with no sanitization on either platform.

7.3 Differences Between Platforms

Note on UIWebView timeline: Apple introduced WKWebView as the successor in iOS 8 (2014). UIWebView was formally deprecated in iOS 12 (2018). The App Store stopped accepting new apps using UIWebView in April 2020 and updates to existing apps in December 2020. UIWebView was never formally removed from the SDK — it remains present but is no longer accepted for App Store submissions. Its security weaknesses relevant here are that it runs in-process (no separate WebContent process), has no Content Security Policy support, and executes injected JavaScript synchronously on the main thread via stringByEvaluatingJavaScriptFromString:.

7.4 Implication

Read It Later, Inc. — and subsequently Mozilla after acquisition — shipped the same unsanitized .html() injection pattern, in a file of the same name, with the same unaddressed TODO comment, across the product's entire 18-year lifespan (2007 → 2025), confirmed by MITRE as affecting all versions from v0 through v8.33.0.0.

This includes the period after the formal CWE-79 report of 2024-07-10. At least one further Android release line was produced in 2024–2025 (culminating in v8.33.0.0) with the vulnerable code preserved verbatim.

8. Root Cause Analysis

Pocket's article reader injects raw externally-sourced HTML into the DOM via $(document.body).html(content) with no sanitization. The // TODO comment at line 95 confirms the code was never production-hardened. This architectural choice was present from the earliest mobile builds (see §7) through the final Android release v8.33.0.0 — unchanged across approximately 13 years and at least one full ownership transition, and unchanged after a formal security report in July 2024.

For the post-2024 vendor response timeline and the precise sequence between the formal CWE-79 report, Mozilla's refusal, and the final unpatched release, refer to §6.

9. Temporary Mitigations

No vendor mitigations exist or are forthcoming.

For end users: Uninstall com.ideashower.readitlater.pro immediately. Revoke Google OAuth grants.

For security community: This case qualifies as a "Forever-Day" vulnerability — confirmed, unpatched, in abandoned software with no remediation path available. Suitable for classification under the Unsupported When Assigned tag per MITRE EOL policy.

10. Verification Methodology

APK analyzed: com.ideashower.readitlater.pro_8.33.0.0.apk

Tools: Android Studio, DEX2JAR, manual code review, binary AXML parsing (UTF-16LE), Protocol Buffer schema inspection, DEX string extraction. iOS bundle inspected via string extraction and source review of the embedded JavaScript pipeline.

Evidence chain:

1. APK acquired
   └── com.ideashower.readitlater.pro_8.33.0.0.apk

2. Decompiled
   ├── assets/html/j/articleview-mobile.js   (XSS — lines 95–99)
   ├── assets/html/article-mobile.html       (jQuery 3.4.1)
   ├── AndroidManifest.xml                   (DownloadingService, SDK receivers)
   └── classes.dex / classes2.dex / classes3.dex

3. iOS counterpart bundle acquired and analyzed
   └── ReadItLaterPro.app (Pocket iOS v4.5.2)
       └── manifest/cache/j/articleview-mobile.js (XSS — lines 97–107)
       └── full analysis: iOS_forensic_analysis_v4.5.2.md

4. Vendor communication record
   └── Original emails verified: POCKET_MAIL.pdf, POCKET_MAIL1.pdf, CRONO2.pdf
       First report: 2021-04-19
       XSS formally reported: 2024-07-10
       Vendor final refusal: 2024-07-11

5. Dynamic evidence
   └── Video recording 2026-01-02: app fully operational post-sunset on real device

11. CVE Record

CVE ID: CVE-2026-82090 — Published 2026-08-28 by MITRE Corporation (CNA). Originally submitted as CAN-2026-2030598 via cveform.mitre.org.

Vendor: Mozilla Corporation Product: Pocket (Android) Version: 8.33.0.0 Vulnerability Type: Cross-Site Scripting (XSS)

Description (for cveform.mitre.org):

** UNSUPPORTED WHEN ASSIGNED ** A DOM-Based Cross-Site Scripting
(XSS) vulnerability (CWE-79) in the articleview-mobile.js
component of Mozilla Pocket for Android through version 8.33.0.0
allows remote attackers to execute arbitrary JavaScript within
the application's WebView. By leveraging the background
DownloadingService, a crafted HTML payload is processed
automatically without user interaction (zero-click), allowing
interaction with the native PocketAndroidArticleInterface Java
bridge.
NOTE: This product is End-of-Life and no longer supported by
the vendor.

Additional Information / Vendor Communication:

First disclosure: 2021-04-19 (paywall bypass).
Formal security report identifying XSS (CWE-79): 2024-07-10
to Mozilla Security.
Vendor response (2024-07-11): Product declared out of scope.
Final APK v8.33.0.0 released in 2025 with vulnerable code
unchanged. Service sunset 2025-07-08. Product is abandoned.
The same vulnerable line is present in the iOS counterpart
bundle (ReadItLaterPro.app, v4.5.2, circa 2012), evidencing
~13 years of unmodified shipment across both mobile platforms.

12. References

• CVE-2026-82090 (official record): https://www.cve.org/CVERecord?id=CVE-2026-82090
• CWE-79: https://cwe.mitre.org/data/definitions/79.html
• CWE-116: https://cwe.mitre.org/data/definitions/116.html
• CVSS v4.0 Specification: https://www.first.org/cvss/v4.0/specification-document
• MITRE CVE EOL Process: https://www.cve.org/Resources/General/End-of-Life-EOL-Assignment-Process.pdf
• MITRE CNA Operational Rules: https://www.cve.org/resourcessupport/allresources/cnarules
• jQuery .html() behavior: https://api.jquery.com/html/
• Android addJavascriptInterface: https://developer.android.com/reference/android/webkit/WebView#addJavascriptInterface(java.lang.Object,%20java.lang.String)
• Apple — UIWebView deprecation: https://developer.apple.com/documentation/uikit/uiwebview
• Apple — Updating Apps that Use Web Views (App Store UIWebView deadlines): https://developer.apple.com/news/?id=12232019b
• Read It Later → Pocket rebrand (17 April 2012): https://blog.getpocket.com/2012/04/introducing-the-all-new-read-it-later-now-called-pocket/

Ing. Zampier Zago (FUNFACTOR1) — Section 1 — Department of Cyber Security, PS 1978 Limited — [email protected] — www.ps1978ltd.it — https://github.com/FUNFACTOR1