---
id: CVE-2026-106715
title: >-
  NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted
  in its WebView JavaScript bridge origin check
summary: >-
  NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted
  in its WebView JavaScript bridge origin check. An attacker can supply such a
  page through the newsbreak://openweb deep link and invoke NBJS.callNative with
  the …
severity: none
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T14:20:55.235Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-106715'
references:
  - url: 'https://github.com/Siestazzz/myVulnDB/tree/main/Mobile/NewsBreak_26.21.0'
  - url: >-
      https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/NewsBreak_26.21.0/report.en.md
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.874Z'
epss: 0.00156
epssPercentile: 0.04763
---

## Overview

NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. An attacker can supply such a page through the newsbreak://openweb deep link and invoke NBJS.callNative with the getLoginInfo action, disclosing a signed-in user's account information and session token after the user opens the crafted link.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.