Chewy Android App Host Header Validation Bypass Exposes Pet Profiles

Executive Summary

CVE-2026-106714 is a WebView security vulnerability in Chewy for Android version 26.23.0. It allows an attacker to trick a signed-in user into opening a malicious link that routes to a privileged WebView. This WebView exposes sensitive JavaScript bridges, such as nma_petmd_bridge.getPetProfiles(), which can be invoked to retrieve a user's pet profile information, including personal identifiers like pet names, types, and breeds.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Android apps for WebView usage with exposed JavaScript bridges. Check for deep-link handling in Chewy app version 26.23.0. Look for network traffic containing pet profile data exfiltration attempts. Monitor for unauthorized access to nma_petmd_bridge.getPetProfiles().

• Use Android Studio to decompile the Chewy app and search for WebView configurations with JavaScript interfaces.
• Check network logs for HTTPS requests to attacker-controlled domains after opening /dp/<number> links.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker to access your pet profile data, including sensitive information like pet names, types, breeds, and timestamps. The attacker could trick you into clicking a malicious link, which would then load in a WebView that exposes this data via JavaScript bridges. The impact is limited to pet profile disclosure and does not appear to affect other user data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with data protection regulations like GDPR, as it involves unauthorized access to personal data (pet profiles). GDPR requires organizations to protect personal data and report breaches. While HIPAA primarily applies to healthcare data, pet profile information might not fall under its scope unless linked to identifiable health details. However, the disclosure of personal identifiers could still raise compliance concerns under GDPR.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Chewy for Android to the latest version beyond 26.23.0. Disable JavaScript bridges not required for core functionality. Implement strict deep-link validation for /dp/<number> paths. Set WebView settings to MIXED_CONTENT_NEVER_ALLOW and verify origin checks for all permission requests.

• Block or restrict access to suspicious domains hosting crafted /dp/<number> links until the app is updated.
• Educate users to avoid clicking untrusted links, especially those containing /dp/ paths.

Useful 0 Not Useful 0