CVE-2026-106715
Description
A flaw was found in NewsBreak. This vulnerability allows for information disclosure because the application improperly trusts data URLs during internal web browser (WebView) origin validation. By tricking a user into opening a crafted deep link, a remote attacker can invoke internal interface functions to access the signed-in user's account details and session tokens.
Statement
This vulnerability is rated as Moderate impact because exploitation requires victim interaction through deep links and is restricted to exposing client credential data rather than allowing system compromise. NewsBreak is an Android-specific mobile application and is not included, supported, or distributed in any Red Hat products. Therefore, Red Hat enterprise offerings are unaffected by this vulnerability.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
An attacker can access any functionality that is inadvertently accessible to the source.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
