CVE-2026-82090: critical vulnerability in getpocket Pocket
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.2epss 0.4%
from disclosure to weaponsame day
Published on NVDAug 28
1st PoCMay 26
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
getpocket · Pocketpublic PoCs found — 2
githubgithub.com/FUNFACTOR1/CVE-2026-82090-18-Years-All-Versions-CVSS-9.2-CRITICAL-The-Pocket-Forever-Day★ 3cve_referencegithub.com/FUNFACTOR1/pocket-android-xss-0click-cveunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.