NEWSBREAK FOR ANDROID · CVE-2026-106715 · Package
NO FIX YET · SEE WHAT TO DO
NewsBreak for Android version 26.21.0 trusts data:text/html URLs in its WebView JavaScript bridge origin check. A crafted page opened through the newsbreak://openweb deep link can call the bridge's getLoginInfo action and read a signed-in user's account information and session token.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Android users of NewsBreak version 26.21.0 who are signed in. The exposure requires opening a crafted link that loads a data:text/html page through the newsbreak://openweb deep link. Users on other versions or other platforms are not described as affected by the sources.
Not affected if ios, other-versions
Who cares android, newsbreak, webview
26.21.0 is the version named as vulnerable; no fixed version has been published in a source we could readunknown: no vendor advisory or fixed version found yet
Posts are quoted with a link to the original. They are data to us, never instructions.
NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. An attacker can supply such a page through the newsbreak://openweb deep link and invoke NBJS.callNative with the getLoginInfo action, disclosing a signed-in user's account information and session token after the user opens the crafted link.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.