{"id":"CVE-2026-102667","published":"2026-10-01T20:17:21.750","lastModified":"2026-10-07T16:17:32.807","description":"Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage.  If the installed app has been granted permissions previously, the attacker can access the entire file system, camera, microphone, and GPS tracking.","cvssScore":8.3,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-749"],"vendors":[],"products":[],"references":[{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-275-03.json","tags":[]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102667","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Joyland AI app allows attackers with shared network access to inject JavaScript, potentially leading to unauthorized access to sensitive data and device resources.","exploitability":"Exploitation requires shared network access and could be feasible for attackers with network proximity to the target device.","blast_radius":"If exploited, the impact could be severe, allowing full access to the device’s file system, camera, microphone, and GPS, posing a significant risk to user privacy and device security.","remediation":"Disable the WebView feature in the Joyland AI app or restrict network access to the app to prevent unauthorized JavaScript injection.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","js-injection","network-access","privacy"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-05T08:42:48.494Z"}}