PT-2026-137482
CVE-2026-106714
·
Published
2026-11-05
·
Updated
2026-11-05
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/ path can access the injected nma petmd bridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in user's pet profile information after the user opens the crafted link.
Found an issue in the description? Have something to add? Feel free to write us 👾