← CVE Radar
CVE-2026-106714
Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/<number> path can access the injected nma_petmd_bridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in user's pet profile information after the user opens the crafted link.
EPSS 0.15%Not in KEVNVD: Received
Overview
Severity
No CVSS score has been published for CVE-2026-106714 yet.
Details
- CVE ID
- CVE-2026-106714
- Status
- Received
- Assigner (CNA)
- mitre
- Published
- Nov 5, 2026
- Last modified
- 2026-11-05 15:17 UTC
Affected Products
No affected products have been published for this CVE yet.