Description (CNA)
Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed app has been granted permissions previously, the attacker can access the entire file system, camera, microphone, and GPS tracking.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Joyland / Joyland.ai | affected * |
CWE
CWE-749
References
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-275-03.json
- https://www.cve.org/CVERecord?id=CVE-2026-102667
ADP enrichment
No English description supplied.
No references supplied.