What’s Vulnerable › Vulnerabilities

CVE-2026-78325: XSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML Import

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-07 · updated 2026-09-09
• Weakness: CWE-79

Description

Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and note data, and arbitrary invocation of native device APIs.

Affected products

• Standard Notes: through v3.201.24

References

• https://github.com/standardnotes/app/compare/%40standardnotes/desktop%403.201.24...%40standardnotes/desktop%403.201.25
• https://proton.me/security/security-advisories

Get alerted when CVE-2026-78325 or the next vulnerability affects your stack