Description
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and note data, and arbitrary invocation of native device APIs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Standard Notes | Standard Notes | ≤ v3.201.24 | — |