CVE Catalog
CVE-2026-82090
CriticalCVSS 9.2Summary
XSS vulnerability in Pocket up to version 8.33.0.0. The 'Save to Pocket' feature injects external HTML into the DOM, allowing JavaScript code to alter application state via native bridge methods.
Risk Assessment
An attacker can exploit XSS to hijack user sessions or manipulate the app, potentially leading to data theft or unauthorized actions.
Recommendation
Update Pocket to the latest version. Avoid saving unverified content and apply client-side security measures.
Original NVD description (English source)
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods.