by Kastro
Paper/Archive/CVE-2026-82090

CVE-2026-82090

getpocket Pocket — Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM.

EPSS 0.4%public exploitCVSS 9.2
critical.is priorityof 100
45
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 38.0.380 × 207.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM.  JavaScript code can alter the application state via native bridge methods.

Affected

ProductAffectedFixed inSource
Pocket≤ 8.33.0.0–CNA

Scores by source

mitre (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/FUNFACTOR1/pocket-android-xss-0click-cve