ReelShort for Android version 3.8.55 exposes Android and Offerwall JavaScript bridges in a WebView without validating the origin of loaded pages. The application accepts a cmsvictor://open deep link that contains an attacker‑controlled activityUrl. When a user opens such a crafted link, the page loaded in the WebView can call privileged JavaScript functions getUserInfo, getCredentials, and initUser. These functions return sensitive user metadata and an encrypted credential payload, allowing an attacker to steal login credentials or other personal data. The vulnerability therefore leads to a breach of confidentiality and could enable account takeover if the cryptographic protection is weak or if the ciphertext can be used directly.

ReelShort for Android version 3.8.55. No other vendors or product versions are listed.

The CVSS score is not provided, and no EPSS data or KEV status is available, but the lack of origin validation combined with the ability to invoke credential‑exposing APIs makes the issue high risk. The attack requires the victim to click a crafted deep link, so it is a user‑interaction vulnerability. Once the link is followed, an attacker can retrieve user credentials and personal data without further exploitation steps. Because the vulnerability allows direct extraction of protected data, it has a severity that warrants rapid attention.