CVE-2026-13461
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A vulnerability in the PayRange app version 7.0.7 allows JavaScript injection into a WebView when combined with an SSL bypass. Injecting specific JavaScript function calls enables the attacker to escape the WebView sandbox and perform dangerous actions on the user's device.
Risk Assessment
An attacker can access sensitive data on the device, install malware, or take control of the app, posing a serious threat to user privacy and security.
Recommendation
Immediately update the PayRange app to the latest available version that fixes this vulnerability. Until updated, avoid using the app on untrusted networks.
Original NVD description (English source)
When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app. The injection of specific JavaScript function calls allows the attacker to escape the WebView sandbox and perform a number of dangerous actions on the user's device.