CVE-2026-106716
Description
A flaw was found in ReelShort. A remote attacker could obtain sensitive user metadata and credentials by tricking a user into opening a crafted deep link. The application renders attacker-supplied web addresses in an internal web browser view without properly validating the origin, permitting malicious web content to invoke exposed application interfaces to access user data.
Statement
This vulnerability is rated Moderate rather than Important because successful exploitation depends on explicit user interaction to trigger an untrusted URI handler, limiting the blast radius to client session information without granting administrative control or system-wide compromise. Furthermore, ReelShort is a proprietary mobile application for the Android platform that is not distributed, packaged, or supported in any Red Hat product offerings. Consequently, Red Hat enterprise software is unaffected by this vulnerability.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability,Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Read Application Data; Modify Application Data; Execute Unauthorized Code or Commands; Other
Exposing critical functionality essentially provides an attacker with the privilege level of the exposed functionality. The consequences may vary depending on the behavior of the exposed method. Typically, this could result in the modification or exposure of sensitive data or possibly even execution of arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
