Düşük
CVE-2026-106714: CVE-2026-106714: güvenlik açığı
Açıklama (NVD)
Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/<number> path can access the injected nma_petmd_bridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in user's pet profile information after the user opens the crafted link.
Özet bilgiler
- EPSS
- %0,16 (yüzdelik 5)
- Yama
- Yok / bilinmiyor