Skip to content

CVE record · 1 source

CVE-2026-106714

Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView.

Vendor: Google
Product: Android
Exposure class: Mobile OS

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

26

CVE NVD 9h ago

Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView.

Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/<number> path can access the injected…

CVE-2026-106714 Google