Vulnerability · Published Sep 7, 2026 · Assigned by Proton

CVE-2026-78325XSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML Import

Medium 6.9

In plain English

A medium-severity cross-site scripting in Standard Notes from Standard Notes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.1%top 98.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and note data, and arbitrary invocation of native device APIs.

Affected products (as reported)

Vendor	Product	Versions
Standard Notes	Standard Notes	0 – through v3.201.24

Weakness: CWE-79 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

In plain English

Official description

Affected products (as reported)

References