Mozilla Pocket Android 0-Click DOM XSS with JS Bridge Abuse (CAN-2026-0205098)

Vulnerability Overview Vulnerability Name: DOM-Based 0-Click Cross-Site Scripting (XSS) in Pocket Android, leading to JavaScript Bridge Abuse CVE ID: CAN-2026-0205098 (submitted by Mitre) Vulnerability Type: DOM-Based XSS (0-click) → JavaScript Bridge Abuse CWE: CWE-79 (Improper Input Validation), CWE-116 (Improper Output Encoding/Escape) CVSS v4.0 Score: 9.2 (CRITICAL) Root Cause: External HTML content is inserted into the DOM without escaping ( ), and the jQuery version is outdated (3.5.9), failing to invoke the escape mechanism of Attack Chain: Content Injection → Zero-Click Background Sync Service Auto-Rendering → JS Execution in Hidden WebView → Invocation of native methods via the bridge (e.g., , ) Scope of Impact Remediation Official Fix: Mozilla fixed this vulnerability in v8.33.0 (released 2025-07-08) Current Status: The product was discontinued on 2025-07-08 (TERMINATED); all installed instances remain permanently vulnerable, with no subsequent patches Mitigation: Since the product is deprecated, it is recommended that users uninstall the Pocket Android application or migrate to alternative reading/bookmarking tools POC / Exploit Code Reproduction Steps: 1. Deploy the above HTML file to a public URL 2. The victim clicks the URL (or the background sync service fetches it automatically) 3. Without user interaction, the handler automatically executes bridge calls and injects the HTML 4. XSS is triggered in Pocket Android's hidden WebView, enabling further invocation of native bridge methods to achieve data leakage or functional abuse

Goal Reached Thanks to every supporter — we hit 100%!

Mozilla Pocket Android 0-Click DOM XSS with JS Bridge Abuse (CAN-2026-0205098)

More from this source