CVE-2026-44698

Name of the Vulnerable Software and Affected Versions Home Assistant Companion app for iOS versions prior to 2026.4.1 Home Assistant Companion app for Android versions prior to 2026.4.4

Description The Home Assistant Companion apps for Android and iOS expose a JavaScript bridge to the in-app WebView. On Android, this is via 'window.externalApp', and on iOS, it is via 'webkit.messageHandlers.getExternalAuth', 'revokeExternalAuth', and 'externalBus'. Two flaws allow this bridge to be accessed by all frames, including cross-origin iframes. Additionally, unsanitized interpolation of the JavaScript callback identifier enables a cross-origin iframe rendered within the app to execute arbitrary JavaScript in the main-frame origin of the Home Assistant frontend, which can be used to exfiltrate the signed-in user's access token.

Recommendations Update the iOS app to version 2026.4.1. Update the Android app to version 2026.4.4.