← CVE Radar
CVE-2026-106715
NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. An attacker can supply such a page through the newsbreak://openweb deep link and invoke NBJS.callNative with the getLoginInfo action, disclosing a signed-in user's account information and session token after the user opens the crafted link.
EPSS 0.15%Not in KEVNVD: Received
Overview
Severity
No CVSS score has been published for CVE-2026-106715 yet.
Details
- CVE ID
- CVE-2026-106715
- Status
- Received
- Assigner (CNA)
- mitre
- Published
- Nov 5, 2026
- Last modified
- 2026-11-05 15:17 UTC
Affected Products
No affected products have been published for this CVE yet.