{"id":"CVE-2026-106715","kind":"vulnerability","aliases":["CVE-2026-106715"],"related":[],"title":"NewsBreak for Android: crafted deep link can leak login session token","description":"NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. An attacker can supply such a page through the newsbreak://openweb deep link and invoke NBJS.callNative with the getLoginInfo action, disclosing a signed-in user's account information and session token after the user opens the crafted link.","summary":"NewsBreak for Android version 26.21.0 trusts data:text/html URLs in its WebView JavaScript bridge origin check. A crafted page opened through the newsbreak://openweb deep link can call the bridge's getLoginInfo action and read a signed-in user's account information and session token.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NewsBreak for Android","fixed":[],"affected":"26.21.0 (other versions not stated by source)","ecosystem":"android"}],"ecosystems":[],"tags":["android","newsbreak","package","webview"],"not_affected_if":["ios","other-versions"],"how_to_check":"Open NewsBreak on Android and check the installed version (Android Settings > Apps > NewsBreak, or the Play Store listing). 26.21.0 is the version named as vulnerable; no fixed version has been published in a source we could read. Only signed-in users who open a crafted newsbreak://openweb link are exposed. Until a fix is confirmed, avoid opening untrusted links that launch the app.","fix":"unknown: no vendor advisory or fixed version found yet","status":"open","published_at":"2026-11-05T15:17:16+00:00","first_seen_at":"2026-11-05T15:39:21+00:00","triaged_at":"2026-11-05T15:41:06+00:00","updated_at":"2026-11-05T15:42:09+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-05T15:41:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"NewsBreak for Android: crafted deep link can leak login session token","impact":"medium","summary":"NewsBreak for Android version 26.21.0 trusts data:text/html URLs in its WebView JavaScript bridge origin check. A crafted page opened through the newsbreak://openweb deep link can call the bridge's getLoginInfo action and read a signed-in user's account information and session token.","audience":"everyone","category":"package","nicknames":[],"who_cares":["newsbreak","android","webview"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"session token and account information disclosed to attacker's page","analyst_note":"Confirm the fixed version and whether a patched release exists; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-106715 was the only source given.","how_to_check":"- Open the NewsBreak app on Android and check the installed version under app settings or the Play Store listing against `26.21.0`\n- unknown","plain_action":"If you use the NewsBreak app on Android, check for an update in the Play Store and install it when one is available.","needs_analyst":true,"not_affected_if":["other-versions","ios"],"who_is_affected":"Android users of NewsBreak version 26.21.0 who are signed in. The exposure requires opening a crafted link that loads a data:text/html page through the newsbreak://openweb deep link. Users on other versions or other platforms are not described as affected by the sources.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":4251,"output_tokens":561,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether a patched release exists; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-106715 was the only source given.","search":"'-106715':14A,17A '-2026':13A,16A '26.21.0':29B,74C 'account':65B,114C 'action':56B,106C 'android':3A,20A,21B,27B,72C 'attack':89C 'bridg':38B,53B,85C 'call':51B 'check':40B,87C 'craft':4A,42B,124C 'cve':12A,15A 'data':31B,76C 'deep':5A,48B,98C 'disclos':107C 'for':19A 'getlogininfo':55B,105C 'inform':66B,115C 'invok':101C 'javascript':37B,84C 'leak':8A 'link':6A,49B,99C,125C 'login':9A 'nbjs.callnative':102C 'newsbreak':1A,18A,22B,25B,70C 'open':44B,122C 'openweb':47B,97C 'origin':39B,86C 'packag':23B 'page':43B,94C 'read':58B 'session':10A,68B,117C 'sign':61B,110C 'signed-in':60B,109C 'suppli':91C 'text/html':32B,77C 'token':11A,69B,118C 'treat':75C 'trust':30B,80C 'url':33B,78C 'user':63B,112C,121C 'version':28B,73C 'webview':24B,36B,83C","nicknames":[],"mitigations":[],"who_affected":"Android users of NewsBreak version 26.21.0 who are signed in. The exposure requires opening a crafted link that loads a data:text/html page through the newsbreak://openweb deep link. Users on other versions or other platforms are not described as affected by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you use the NewsBreak app on Android, check the Play Store for an update and install it when one is available.","pkeys":["forandroid","newsbreakforandroid"],"ptokens":["android","for","newsbreak"],"labels":["android","high","newsbreak","package","webview"],"campaign_type":null,"first_public_at":"2026-11-05T15:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106715","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106715","severity":null,"published_at":"2026-11-05T15:17:16+00:00","modified_at":"2026-11-05T15:17:16+00:00","first_seen_at":"2026-11-05T15:39:21+00:00","fetched_at":"2026-11-05T15:39:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-106715:1793","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106715","severity":null,"published_at":"2026-11-05T15:42:09+00:00","modified_at":"2026-11-05T15:42:09+00:00","first_seen_at":"2026-11-05T15:42:09+00:00","fetched_at":"2026-11-05T15:42:09+00:00","note":"Only NVD description found (no vendor/maintainer advisory, no patched version, no PoC or exploitation reports located via web search). Fix unknown; nothing verified. Revisit when NewsBreak or Play Store lists a fixed build.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-106715"]}],"documents":[{"id":77388,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106715","title":"NVD: CVE-2026-106715","kind":"other","source":"analyst","publisher":null,"text":"NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. An attacker can supply such a page through the newsbreak://openweb deep link and invoke NBJS.callNative with the getLoginInfo action, disclosing a signed-in user's account information and session token after the user opens the crafted link.","published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}