CVE-2026-78325: Standard Notes

Medium severity, CVSS 6.9. EPSS: 0.1% chance of exploitation in the next 30 days.

Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and note data, and arbitrary invocation of native device APIs.

Affected products

• Standard Notes Standard Notes: up to and including v3.201.24

Published 2026-09-07. Last modified 2026-09-09.