CVE-2026-106714 · Other
NO FIX YET
Chewy for Android version 26.23.0 does not check the host of a product-details deep link before loading it in an in-app WebView. A crafted page can call an exposed JavaScript bridge and read a signed-in user's pet profile information.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Android users of the Chewy app on version 26.23.0 who sign in and open a crafted product link. The sources do not describe server-side exposure, so businesses running Chewy's backend are not indicated as affected.
Not affected if ios-only-users, no-link-opened, other-app-versions
Who cares android, chewy, mobile
No fix yet, per the sources.
Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/<number> path can access the injected nma_petmd_bridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in user's pet profile information after the user opens the crafted link.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.