Joyland AI app: Script injection into WebView content
Summary
The Joyland AI app allows an attacker on the same network to inject JavaScript into content loaded in its WebView. Without permissions granted by the user, the attacker can access the clipboard, send arbitrary HTTP requests via the Weex 'stream' module, and read app-internal storage. If the app already has permissions, the attacker can also reach the file system, camera, microphone and GPS location.
Affected
- Joyland.ai (Joyland AI app), all versions (vers:all/*) according to the CNA record.
- Specific version numbers: Unknown.
Fixed in
- Unknown. No fix is available according to CISA advisory VA-26-275-03.
Workaround
- Uninstall the app from affected devices, or block its network access with firewall rules.
- Revoke permissions already granted to the app (storage, camera, microphone, location).
- Do not use the app on untrusted or shared Wi-Fi networks.
Exploitation
- Not known to be exploited.
- No public proof of concept found.
- CNA SSVC assessment: Exploitation none, Automatable no.
Our recommendation
- Check whether the app is installed on company or BYOD devices.
- Uninstall the app or restrict its use until Joyland provides a fix.
- Avoid untrusted and shared Wi-Fi networks when using the app.
- Revoke app permissions for storage, camera, microphone and location.
- Monitor the CISA advisory and Joyland for a fix.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-102667 www.cve.org
- CISA CSAF advisory VA-26-275-03 raw.githubusercontent.com
- VulDB CVE-2026-102667 vuldb.com
- OpenCVE CVE-2026-102667 app.opencve.io
- OffSeq Radar CVE-2026-102667 radar.offseq.com
- HOL Guard CVE-2026-102667 hol.org
- Strix CVE-2026-102667 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:18.
Original description (NVD)
Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed app has been granted permissions previously, the attacker can access the entire file system, camera, microphone, and GPS tracking.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.