CVE-2024-46961: Inshot.com X Downloader

High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days.

The Inshot com.downloader.privatebrowser (aka Video Downloader - XDownloader) application through 1.3.5 for Android allows an attacker to execute arbitrary JavaScript code via the com.downloader.privatebrowser.activity.PrivateMainActivity component.

Affected products

• Inshot.com X Downloader: before 1.3.5_for_android (fixed in 1.3.5_for_android)

Published 2024-11-07. Last modified 2026-06-17.