CVE-2026-78325
EUVD-2026-7235407.09.2026, 12:17
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and note data, and arbitrary invocation of native device APIs.
Awaiting analysis
This vulnerability is currently awaiting analysis.