CVE-2019-14757: An issue was discovered in KaiOS 2.5 and 2.5.1. The pre-installed Contacts application is vulnerable to HTML and JavaScr

KaiOS 2.5 and 2.5.1's Contacts app is vulnerable to HTML and JavaScript injection (inserting malicious code into a web application), where an attacker can send a specially crafted vCard file (a contact format) that, when imported, executes their code within the app. This lets attackers manipulate what users see, steal credentials by displaying fake login prompts, or exploit the app's permissions to access sensitive device features.