CVE-2026-106714
Unknown
Description
Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/<number> path can access the injected nma_petmd_bridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in user's pet profile information after the user opens the crafted link.
SeverityUnknown
CVSS—
Exploit probability—
Product—
PublishedNov 5, 2026
First seenNov 5, 2026
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
Sources have not yet published the affected products and versions for this vulnerability.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.