{"id":"CVE-2026-106714","title":"Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView","summary":"Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/<number> path can access the injected nma_petmd_bridge J…","severity":"none","published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T14:19:17.445Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-106714","references":[{"url":"https://github.com/Siestazzz/myVulnDB/tree/main/Mobile/Chewy_26.23.0"},{"url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/Chewy_26.23.0/report.en.md"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T21:36:00.873Z","epss":0.00156,"epssPercentile":0.04764,"slug":"CVE-2026-106714","body":"## Overview\n\nChewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/<number> path can access the injected nma_petmd_bridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in user's pet profile information after the user opens the crafted link.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}