NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check.
NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. An attacker can supply such a page through the newsbreak://openweb deep link and invoke NBJS.callNative with the getLoginInfo action, disclosing a signed-in user's account information and session token after the user opens the crafted link.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Product
- Android
- Exposure class
- Mobile OS
- NVD status
- Received
Why it ranks 26 (Notable)
- Product class: mobile OS
- Widely deployed vendor product (Google)
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.