NewsBreak Android WebView Account Information Disclosure

Executive Summary

CVE-2026-106715 is a vulnerability in NewsBreak for Android version 26.21.0 where the app incorrectly treats data:text/html URLs as trusted in its WebView JavaScript bridge. This allows an attacker to craft a malicious link that, when opened, loads a page in the app's WebView and invokes a sensitive function called getLoginInfo. This function returns the user's account information and session token to the attacker.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the NewsBreak app version 26.21.0 for improper handling of data:text/html URLs in its WebView JavaScript bridge. Check if the app allows deep links like newsbreak://openweb to load malicious HTML content. Review WebView settings for excessive permissions such as file access or mixed-content support.

Useful 0 Not Useful 0

Impact Analysis

If you use NewsBreak for Android version 26.21.0, an attacker could trick you into opening a specially crafted link. This could lead to the disclosure of your account information and session token, potentially allowing the attacker to access your account without your knowledge.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating privacy regulations like GDPR and HIPAA. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. A breach of session tokens and account data could result in non-compliance and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the NewsBreak app to a patched version if available. Disable or restrict the newsbreak://openweb deep link handler if not required. Configure the WebView to enforce strict URL validation, disable file access, and restrict mixed-content loading. Implement origin checks for sensitive JavaScript bridge actions like getLoginInfo.

Useful 0 Not Useful 0