Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView.
Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/<number> path can access the injected nma_petmd_bridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in user's pet profile information after the user opens the crafted link.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Product
- Android
- Exposure class
- Mobile OS
- NVD status
- Received
Why it ranks 26 (Notable)
- Product class: mobile OS
- Widely deployed vendor product (Google)
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.