CVE-2026-102667 — Joyland AI WebView command injection
Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the …
Published: 2026-10-01 · CVSS: 9.0 · CVSS 4.0
Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed app has been granted permissions previously, the attacker can access the entire file system, camera, microphone, and GPS tracking.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7