CVE-2026-106714
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 05, 2026
Vendor
unknown
Description
Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/<number> path can access the injected nma_petmd_bridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in user's pet profile information after the user opens the crafted link.