Vulnerability Bulletins |
CVE-2026-106714 |
|
| Affected software | ANDROID |
| Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/ path can access the injected nma_petmd_bridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in user's pet profile information after the user opens the crafted link. | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-106714 | |