CVE-2019-14759: An issue was discovered in KaiOS 1.0, 2.5, and 2.5.1. The pre-installed Radio application is vulnerable to HTML and Java

KaiOS versions 1.0, 2.5, and 2.5.1 contain a vulnerability in their built-in Radio app that allows HTML and JavaScript injection (code inserted into a program to make it behave unexpectedly). An attacker with local access to the device could inject malicious code to manipulate the app's interface, trick users into revealing passwords, or exploit any permissions the Radio app has been granted.