CVE-2020-5604: Mercari

High severity, CVSS 8.1. EPSS: 2% chance of exploitation in the next 30 days.

Android App 'Mercari' (Japan version) prior to version 3.52.0 allows arbitrary method execution of a Java object by a remote attacker via a Man-In-The-Middle attack by using Java Reflection API of JavaScript code on WebView.

Affected products

• Mercari Mercari: before 3.52.0 (fixed in 3.52.0)

Published 2020-07-09. Last modified 2026-06-17.