CVE-2026-78325 Overview
CVE-2026-78325 is a cross-site scripting (XSS) vulnerability [CWE-79] in the Evernote and Google Keep note importers of Standard Notes for Android through version 3.201.24. An attacker can craft a malicious .enex (Evernote export) or Google Keep HTML file that executes arbitrary JavaScript in the application context when a victim imports it. Successful exploitation exposes encryption keys and note contents, and permits arbitrary invocation of native device APIs exposed to the WebView.
Critical Impact
Successful exploitation leaks user encryption keys and stored notes, and enables the attacker to invoke native device APIs available to the Standard Notes Android application.
Affected Products
- Standard Notes for Android through 3.201.24
- Evernote import functionality (.enex file parser)
- Google Keep import functionality (HTML file parser)
Discovery Timeline
- 2026-09-07 - CVE-2026-78325 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-78325
Vulnerability Analysis
The vulnerability resides in the note importer components that parse third-party export formats. Standard Notes accepts Evernote .enex files and Google Keep HTML exports, then renders their content within the application's WebView. The importers fail to sanitize embedded HTML and script content before rendering. Any executed JavaScript runs inside the trusted application origin, giving it access to encryption keys, stored notes, and JavaScript bridges exposed to the WebView.
Exploitation requires user interaction: the victim must actively import a crafted file. The attack originates locally on the device, meaning the malicious file must reach the user through an out-of-band channel such as email, messaging, or a shared cloud folder. Once imported, script execution occurs immediately without further prompts.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. The .enex and Google Keep HTML parsers treat user-supplied markup as trusted rendering content instead of untrusted data requiring sanitization or encoding. Scripts, event handlers, and JavaScript URIs embedded in imported notes reach the DOM intact.
Attack Vector
An attacker builds a malicious .enex or Google Keep HTML file containing JavaScript payloads inside note bodies, attributes, or embedded HTML. The attacker delivers the file to the victim. When the victim imports the file into Standard Notes for Android, the payload executes with the privileges of the application, reads the user's encryption keys and decrypted note data, and can call any native APIs bridged to the WebView. See the Standard Notes 3.201.25 release comparison for the corresponding patch changes.
Detection Methods for CVE-2026-78325
Indicators of Compromise
- Presence of .enex or Google Keep HTML files containing <script> tags, on* event handlers, or javascript: URIs in note bodies or attributes.
- Unexpected outbound network connections from the Standard Notes Android application shortly after an import action.
- Unexplained sync activity or new device registrations tied to a Standard Notes account following a note import.
Detection Strategies
- Inspect imported files at mobile device management (MDM) and email gateway layers for HTML script constructs inside .enex archives or Google Keep exports.
- Monitor mobile telemetry for Standard Notes application versions at or below 3.201.24 still present in the environment.
- Correlate note import events with subsequent anomalous network egress from the mobile endpoint.
Monitoring Recommendations
- Track installed application versions across the mobile fleet and flag Standard Notes builds through 3.201.24.
- Alert on delivery of .enex files and Google Keep HTML exports from untrusted senders through mail and collaboration platforms.
- Review Standard Notes account activity logs for unexpected sessions or key regeneration events after suspected imports.
How to Mitigate CVE-2026-78325
Immediate Actions Required
- Upgrade Standard Notes for Android to the fixed release available after version 3.201.24.
- Instruct users to avoid importing .enex or Google Keep HTML files received from untrusted or unverified sources.
- Rotate Standard Notes account credentials and re-encrypt notes if a suspicious import occurred on any device.
Patch Information
The issue is addressed in the release that follows 3.201.24. Refer to the vendor commit history in the Standard Notes GitHub release comparison and the Proton Security Advisories for the official fix and supporting details.
Workarounds
- Disable or avoid the Evernote and Google Keep import features until the application is updated.
- Pre-sanitize any .enex or Google Keep HTML files in a controlled environment before importing them into Standard Notes.
- Restrict distribution of note export files through mobile threat defense policies and content filtering rules.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
