CVE-2026-106714
Description
A flaw was found in Chewy for Android. The application fails to properly validate the host domain of a product-details deep link before rendering it in an embedded web view. A remote attacker could exploit this vulnerability by convincing a signed-in user to open a crafted link, allowing an attacker-controlled webpage to access internal application interfaces and disclose the user's pet profile information.
Statement
This vulnerability is rated as Moderate because successful exploitation is limited to unauthorized information disclosure and requires victim interaction to trigger the crafted link. The issue specifically targets the third-party Chewy application on the Android platform, which is not packaged, shipped, or maintained within any Red Hat products. Consequently, Red Hat enterprise offerings are not affected by this flaw.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
An attacker can access any functionality that is inadvertently accessible to the source.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
