CVE-2023-27108

CVE-2023-27108 is a medium-severity vulnerability affecting KaiOS 3.0, where the pre-installed Communications application exposes a Web Activity that allows unauthorized access to a user's call log. An attacker can inject a JavaScript payload without user interaction or consent, enabling the exfiltration of call logs to a remote server. The CVSS score is 5.3 (Medium), indicating a network-based attack with low complexity and no user interaction required, leading to a potential loss of confidentiality. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.