CVE-2026-106714: Security vulnerability

Published Nov 5, 2026

Updated

Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/<number> path can access the injected nmapetmdbridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in user's pet profile information after the user opens the crafted link.

Event History

Nov 5, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·03:17 PM

Description

Frequently Asked Questions

Who is exposed to this issue?

Signed-in Chewy for Android users who open an attacker-crafted product-details deep link are exposed. The disclosed data is pet profile information available through the app's injected JavaScript interface.

What does an attacker need to exploit it?

The attacker needs to host or control a page whose path matches /dp/<number> and persuade a signed-in user to open the crafted deep link. The issue occurs because the app does not adequately validate the page host before loading it in the Hybrid WebView.

How can teams determine whether they are affected?

Verify whether the Android app is version 26.23.0 and test product-details deep links that load an untrusted host with a /dp/<number> path. An affected app allows that page to access nma_petmd_bridge and invoke getPetProfiles.

CVE-2026-106714: Security vulnerability

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can teams determine whether they are affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can teams determine whether they are affected?