CVE-2026-102667

Summary

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed app has been granted permissions previously, the attacker can access the entire file system, camera, microphone, and GPS tracking.

Affected Software

VendorProductVersion RangeStatus
JoylandJoyland.ai*affected

Weaknesses

  • CWE-749: CWE-749 Exposed Dangerous Method or Function

References