CRITICAL 9.0 NVD
CVE-2026-102667
Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker
Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed app has been granted permissions previously, the attacker can access the entire file system, camera, microphone, and GPS tracking.
References
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-275-
- https://www.cve.org/CVERecord?id=CVE-2026-1026667
This critical severity vulnerability with a CVSS score of 9.0 was published on 2026-10-01 via NVD.
Risk Timeline
CVE Disclosed2026-10-01 · -1 days ago
Remediation Resources
Official Advisory
www.cve.org/CVERecord?id=CVE-2026-1026667
vulnfeed aggregates 9446 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.