UNKNOWNCVSS not yet scoredVulnerability
CVE-2026-106714
Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/<number> path can access the injected nma_petmd_bridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in user's pet profile information after the user opens the crafted link.
Properties
- Last source
- NVD
- Nvd fetched at
- 2026-11-05T18:05:53.357748+00:00
- Cve id
- CVE-2026-106714
- First seen by Signal
- 2026-11-05T18:02:03+00:00
- Retrieved at
- 2026-11-05T18:06:50+00:00
- Published at
- 2026-11-05T15:17:16.767
- Last modified
- 2026-11-05T15:17:16.767
Explore deeper with Ninja Signal's threat intelligence graph