{"id":"CVE-2026-106714","kind":"vulnerability","aliases":["CVE-2026-106714"],"related":[],"title":"Chewy Android app: deep link lets web page read pet profiles","description":"Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/<number> path can access the injected nma_petmd_bridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in user's pet profile information after the user opens the crafted link.","summary":"Chewy for Android version 26.23.0 does not check the host of a product-details deep link before loading it in an in-app WebView. A crafted page can call an exposed JavaScript bridge and read a signed-in user's pet profile information.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","chewy","mobile","other"],"not_affected_if":["ios-only-users","no-link-opened","other-app-versions"],"how_to_check":"- Check the installed Chewy app version in the Android app settings; the sources name version 26.23.0 as affected.","fix":null,"status":"open","published_at":"2026-11-05T15:17:16+00:00","first_seen_at":"2026-11-05T15:39:21+00:00","triaged_at":"2026-11-05T15:41:06+00:00","updated_at":"2026-11-05T15:41:06+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-05T15:41:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Chewy Android app: deep link lets web page read pet profiles","impact":"low","summary":"Chewy for Android version 26.23.0 does not check the host of a product-details deep link before loading it in an in-app WebView. A crafted page can call an exposed JavaScript bridge and read a signed-in user's pet profile information.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","chewy","mobile"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"A web page reads signed-in user's pet profile data through an app bridge.","analyst_note":"","how_to_check":"- Check the installed Chewy app version in the Android app settings; the sources name version 26.23.0 as affected.","plain_action":"If you use the Chewy app on Android, update it to a newer version from the Play Store once Chewy publishes a fix.","needs_analyst":false,"not_affected_if":["other-app-versions","ios-only-users","no-link-opened"],"who_is_affected":"Android users of the Chewy app on version 26.23.0 who sign in and open a crafted product link. The sources do not describe server-side exposure, so businesses running Chewy's backend are not indicated as affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000662,"input_tokens":4241,"output_tokens":476,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-106714':14A,17A '-2026':13A,16A '/dp':99C '26.23.0':25B,71C 'access':102C 'adequ':74C 'android':2A,18B,23B,69C 'app':3A,45B 'attack':94C 'attacker-control':93C 'bridg':55B,107C 'call':51B 'check':28B 'chewi':1A,19B,21B,67C 'control':95C 'craft':48B,128C 'cve':12A,15A 'deep':4A,36B,83C 'detail':35B,82C 'disclos':113C 'expos':53B 'getpetprofil':112C 'host':30B,77C 'hybrid':90C 'in-app':43B 'inform':66B,122C 'inject':104C 'interfac':109C 'invok':111C 'javascript':54B,108C 'let':6A 'link':5A,37B,84C,129C 'load':39B,86C 'mobil':20B 'nma':105C 'open':126C 'page':8A,49B,96C 'path':100C 'pet':10A,64B,120C 'petmd':106C 'product':34B,81C 'product-detail':33B,80C 'profil':11A,65B,121C 'read':9A,57B 'sign':60B,116C 'signed-in':59B,115C 'user':62B,118C,125C 'valid':75C 'version':24B,70C 'web':7A 'webview':46B,91C","nicknames":[],"mitigations":[],"who_affected":"Android users of the Chewy app on version 26.23.0 who sign in and open a crafted product link. The sources do not describe server-side exposure, so businesses running Chewy's backend are not indicated as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you use the Chewy app on Android, update it to a newer version from the Play Store once Chewy publishes a fix.","pkeys":[],"ptokens":[],"labels":["android","chewy","medium","mobile","other"],"campaign_type":null,"first_public_at":"2026-11-05T15:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106714","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106714","severity":null,"published_at":"2026-11-05T15:17:16+00:00","modified_at":"2026-11-05T15:17:16+00:00","first_seen_at":"2026-11-05T15:39:21+00:00","fetched_at":"2026-11-05T15:39:21+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}