CVE-2026-106714 in Chewy
Summary
by MITRE • 11/05/2026
Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/<number> path can access the injected nma_petmd_bridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in user's pet profile information after the user opens the crafted link.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Chewy for Android version 26.23.0 represents a critical flaw in how the application handles deep links within its Hybrid WebView implementation. This issue stems from an insufficient validation of the host component of Uniform Resource Identifiers (URIs) provided via product-details deep links. When a user interacts with such a link, the application loads the specified URL into a web view environment that exposes native JavaScript interfaces to the loaded content. The core technical failure lies in the absence of strict origin checking or allow-listing mechanisms before granting these injected bridges access to sensitive internal data structures. Consequently, any webpage hosted on an arbitrary domain can be rendered within this privileged context if it matches specific path patterns, such as those beginning with /dp/, without triggering appropriate security checks that would normally restrict cross-origin interactions.
This architectural weakness allows for a sophisticated attack scenario where an adversary crafts a malicious URL containing the targeted path structure and hosts it on a server under their control. Upon convincing or tricking a signed-in user into opening this link, typically through social engineering tactics like phishing emails or deceptive advertisements, the application loads the attacker's page within the WebView. Because the host validation is inadequate, the browser does not block access to the native bridge object named nma_petmd_bridge. This JavaScript interface serves as a communication channel between the web content and the Android application layer, providing methods that interact directly with the app's internal state. In this specific instance, the getPetProfiles method exposed by this bridge is accessible without proper authorization checks relative to the origin of the loaded page.
The operational impact of this vulnerability is significant for user privacy and data security. Once the attacker-controlled script invokes the getPetProfiles function through the nma_petmd_bridge interface, it can retrieve detailed information about the pets associated with the currently signed-in account. This disclosure includes sensitive personal data that users expect to remain confidential within the application's secure environment. The exposure of pet profile details may include names, breeds, medical histories, or other identifying characteristics linked to the user's identity and location. Such leakage not only violates user trust but also potentially facilitates further targeted attacks by providing adversaries with contextual information about their victims' lives and routines.
From a classification perspective, this vulnerability aligns closely with CWE-20 Improper Input Validation, specifically regarding the failure to verify that input data conforms to expected formats or origins before processing it within a privileged context. It also relates to CWE-749 Exposure of Sensitive Information to an Unauthorized Actor, as the flaw results in the direct disclosure of private user data through an unintended channel. In terms of offensive security frameworks, this exploit technique corresponds to ATT&CK T1059 Command and Scripting Interpreter via JavaScript within a web view context, leveraging native bridge exposure for unauthorized data access. The attack vector is classified as remote with low complexity, requiring only that the victim opens a crafted link while authenticated in the application.
Mitigation strategies must focus on implementing strict origin validation policies for all deep links processed by Hybrid WebViews. Developers should enforce an allow-list of trusted domains and reject any requests originating from unverified hosts before initializing or exposing native JavaScript interfaces. Additionally, it is crucial to review all exposed bridge methods to ensure they perform adequate authorization checks against the current document's origin property. Implementing Content Security Policy headers within the WebView can further restrict script execution and data access patterns. Regular security audits of deep link handling logic and automated testing for cross-origin vulnerabilities are essential to prevent similar issues in future releases, ensuring that sensitive application functions remain isolated from untrusted web content.