---
id: "CVE-2026-106715"
kind: "vulnerability"
aliases: ["CVE-2026-106715"]
title: "NewsBreak for Android: crafted deep link can leak login session token"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "NewsBreak for Android", "fixed": [], "affected": "26.21.0 (other versions not stated by source)", "ecosystem": "android"}]
ecosystems: []
tags: ["android", "newsbreak", "package", "webview"]
not_affected_if: ["ios", "other-versions"]
published_at: "2026-11-05T15:17:16+00:00"
first_seen_at: "2026-11-05T15:39:21+00:00"
updated_at: "2026-11-05T15:42:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106715", "first_seen_at": "2026-11-05T15:39:21+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106715", "first_seen_at": "2026-11-05T15:42:09+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-106715"]}]
exploit_sources: []
---

# NewsBreak for Android: crafted deep link can leak login session token

NewsBreak for Android version 26.21.0 trusts data:text/html URLs in its WebView JavaScript bridge origin check. A crafted page opened through the newsbreak://openweb deep link can call the bridge's getLoginInfo action and read a signed-in user's account information and session token.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- android:NewsBreak for Android affected 26.21.0 (other versions not stated by source) fixed no fixed version listed

## How to check

Open NewsBreak on Android and check the installed version (Android Settings > Apps > NewsBreak, or the Play Store listing). 26.21.0 is the version named as vulnerable; no fixed version has been published in a source we could read. Only signed-in users who open a crafted newsbreak://openweb link are exposed. Until a fix is confirmed, avoid opening untrusted links that launch the app.

## Fix

unknown: no vendor advisory or fixed version found yet

## Timeline

- 2026-11-05T15:39:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106715
- 2026-11-05T15:42:09+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-106715 — Only NVD description found (no vendor/maintainer advisory, no patched version, no PoC or exploitation reports located via web search). Fix unknown; nothing verified. Revisit when NewsBreak or Play Store lists a fixed build.

## Documents

- [describes] NVD: CVE-2026-106715 https://nvd.nist.gov/vuln/detail/CVE-2026-106715

## From the sources

NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. An attacker can supply such a page through the newsbreak://openweb deep link and invoke NBJS.callNative with the getLoginInfo action, disclosing a signed-in user's account information and session token after the user opens the crafted link.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_