CVE-2019-14761: An issue was discovered in KaiOS 2.5. The pre-installed Note application is vulnerable to HTML and JavaScript injection

The Note app pre-installed on KaiOS 2.5 is vulnerable to HTML and JavaScript injection (a type of attack where malicious code is inserted into an application). A local attacker (someone with access to the device) can inject harmful code into the Note app to take over its interface, trick users into giving up login credentials, or exploit any permissions the app has.