CVE-2026-106715 in NewsBreak
Summary
by MITRE • 11/05/2026
NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. An attacker can supply such a page through the newsbreak://openweb deep link and invoke NBJS.callNative with the getLoginInfo action, disclosing a signed-in user's account information and session token after the user opens the crafted link.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in NewsBreak for Android version 26.21.0 represents a critical flaw within the application’s WebView JavaScript bridge implementation, specifically concerning how origin checks are performed when handling deep links. The core technical issue stems from an overly permissive validation logic that incorrectly treats data URIs with the text/html MIME type as trusted origins. In secure mobile architecture, the JavaScript bridge serves as a communication channel between web content rendered in a WebView and native Android components. To prevent unauthorized access to sensitive native functions, applications typically enforce strict origin checks to ensure that only scripts from whitelisted domains can invoke these methods. However, by accepting data:text/html URLs as valid origins, NewsBreak effectively bypasses this security boundary, allowing any HTML content loaded via such a URI to execute privileged JavaScript commands against the native layer without proper authentication or domain verification.
This flaw is exploited through the newsbreak://openweb deep link mechanism, which allows external sources to direct users to specific web views within the application. An attacker can craft a malicious URL that utilizes this deep link scheme and embeds a data URI containing hostile JavaScript code. When an authenticated user clicks on or opens this crafted link, the WebView loads the embedded HTML content. Because of the vulnerability in the origin check logic, the application’s security middleware erroneously validates the source as trusted. This false validation permits the injected script to invoke NBJS.callNative with specific actions, such as getLoginInfo. The NBJS object is a standard interface used for bridging JavaScript and native code, but its methods are intended to be restricted to legitimate internal or verified external sources. By bypassing this restriction, the attacker gains direct programmatic access to sensitive application state data that should remain isolated from untrusted web contexts.
The operational impact of this vulnerability is severe due to the nature of the exposed information. The getLoginInfo action returns comprehensive account details for any user currently signed into the NewsBreak application on the affected device. This disclosure includes personally identifiable information associated with the account as well as critical session tokens. Session tokens are particularly dangerous when compromised, as they serve as temporary credentials that authenticate the user to backend services without requiring a password re-entry. Possession of these tokens allows an attacker to hijack the user’s active session, effectively impersonating them across all features and services tied to their account. This can lead to unauthorized access to private messages, personalized content preferences, payment information if stored or linked, and potentially further exploitation through social engineering attacks leveraging the disclosed personal data. The attack vector is relatively straightforward for end-users who may encounter such links via phishing emails, malicious advertisements, or compromised websites, making it a high-risk threat in real-world scenarios.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. The root cause is a failure in input validation regarding the origin scheme, which falls under CWE-749 Exposed Dangerous Method or Function within the context of mobile application security. In terms of adversary tactics, this exploitation technique maps directly to ATT&CK Mobile ID T1530 Data from Information Repositories and potentially T1056 Input Capture if session tokens are used for further credential harvesting. The lack of strict origin validation is a common anti-pattern in hybrid app development where developers prioritize convenience over security boundaries between web and native layers.
Mitigation strategies must focus on hardening the WebView configuration and tightening the JavaScript bridge permissions. Developers should implement rigorous allowlist-based domain verification rather than relying on broad MIME type checks or trusting data URIs for privileged operations. Specifically, the origin check logic within the NBJS interface must be updated to reject any non-HTTPS origins from external sources unless they are explicitly whitelisted by the application maintainers. Additionally, implementing Content Security Policy (CSP) headers can help restrict script execution contexts and prevent unauthorized injection of code into the WebView environment. It is also recommended to use Android’s built-in security features such as setAllowFileAccess(false) if file access is not strictly required for the specific web view functionality. For users currently affected, immediate updates to a patched version are essential, while temporary mitigation involves avoiding clicking on deep links from untrusted sources and regularly clearing session data through the application settings or device storage management.