qark

Quick Android Review Kit This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. The tool is also capable of creating "Proof-of-Concept" deployable APKs and/or ADB commands, capable of exploiting many of the...

deep-C

Deep-C Deep-C is an Android Deep Link Exploitation Framework that automatically decompiles APKs, identifies exposed and insecure deep link entry points, validates exploitability using static analysis and optional AI verification , and generates executable adb Proof-of-Concepts PoCs. Deep-C is...

CVE-2026-106715

A flaw was found in NewsBreak. This vulnerability allows for information disclosure because the application improperly trusts data URLs during internal web browser WebView origin validation. By tricking a user into opening a crafted deep link, a remote attacker can invoke internal interface...

CVE-2026-54144

The OpenHuman desktop application and Rust library are vulnerable on macOS versions prior to 0.56.0 . The issue resides in the runtime injected into supported remote account webviews (e.g., Google Meet), where a shim fails to reject getDisplayMedia calls made without a live user gesture. Conseque...

CVE-2026-54144 OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesture

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0 on macOS, the runtime injected into a supported remote account webview such as Google Meet allows page JavaScript to call getDisplayMedia without a live user gesture. Instead of rejecting...

apk-interceptor

apk-interceptor Android deeplink, Intent, and WebView bridge assessment helper apk-interceptor is a portable Android testing APK for authorized application security assessments. It helps security engineers verify how an Android app handles external entry points such as custom URI schemes,...

CVE-2026-106715

NewsBreak for Android version 26.21.0 contains a vulnerability where the WebView JavaScript bridge origin check improperly treats data:text/html; URLs as trusted. An attacker can leverage the newsbreak://openweb deep link to supply a crafted page that invokes NBJS.callNative with the getLoginInfo...

EUVD-2026-117512

Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/ path can access the injected nmapetmdbridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in...

EUVD-2026-117514

ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. After a user opens the crafted link, the page can invoke...

CVE-2026-106714

Chewy for Android version 26.23.0 is vulnerable to a deep link security issue because it fails to adequately validate the host of a product-details deep link before loading it in a Hybrid WebView . An attacker can use a crafted page with a /dp/ path to access the injected nma_petmd_bridge JavaScr...

EUVD-2026-117513

NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. An attacker can supply such a page through the newsbreak://openweb deep link and invoke NBJS.callNative with the getLoginInfo action, disclosing a signed-in user's account...

CVE-2026-106716

ReelShort for Android version 3.8.55 is vulnerable to a security flaw where it loads an attacker-controlled activityUrl via the cmsvictor://open deep link. The application fails to validate the page origin within a WebView , exposing the Android and Offerwall JavaScript bridges . An attacker can ...

CVE-2026-121116

A missing authorization flaw was found in the WebView component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/562656015...

SUSE CVE-2026-121116

Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121145

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView. Successful exploitation of...

EUVD-2026-116905

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView. Successful exploitation of...

CVE-2026-121145 Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile application

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView. Successful exploitation of...

CVE-2026-121145

The iRA 2.0 and iRA.ev mobile applications are vulnerable due to insufficient validation of URLs and origins loaded within the WebView component . A remote attacker can exploit this by sending malicious web content to the affected WebView. Successful exploitation may allow an attacker to interact...

CVE-2026-121116

Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

Linux Distros Unpatched Vulnerability : CVE-2026-121116

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to...