Readwise Reader for Android builds URLs in its embedded WebView by directly inserting values from document metadata into URL strings that are then added to the page via innerHTML. Because the metadata values are not encoded for either HTML or JavaScript contexts, an attacker can craft a document whose metadata supplies payload text that breaks out of the intended URL structure and injects executable script. The vulnerability is a stored XSS flaw, meaning that once a malicious document is synchronized to a device it can persistently compromise any user who opens it.

The affected product is Readwise Reader for Android. No specific version information is available in the advisory, so all current and legacy releases could be impacted until a patch is applied.

The advisory does not list a CVSS score, and the EPSS score is not available, so the quantified risk cannot be calculated. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a malicious document containing the crafted metadata and persuade a user to sync and open it; once displayed, the injected script runs in the context of the app, offering potential for session hijacking or data theft. The lack of public exploitation data suggests the threat remains theoretical but standard XSS mitigations apply.