CVE-2026-44698

Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection

State: Published
Severity: 8.3 High
Published: May 29, 2026
Updated: May 29, 2026
Reserved: May 7, 2026

Description

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Home Assistant Companion apps for Android and iOS expose a JavaScript bridge to the in-app WebView window.externalApp on Android and webkit.messageHandlers.getExternalAuth (alongside revokeExternalAuth and externalBus) on iOS. Two flaws expose the bridge to all frames (including cross-origin iframes) and unsanitized interpolation of the JavaScript callback identifier allows a cross-origin iframe rendered inside the Companion app to execute arbitrary JavaScript in the Home Assistant frontend's main-frame origin and exfiltrate the signed-in user's access token. This vulnerability is fixed in 2026.4.1 for iOS and 2026.4.4 for Android.

Scores

CVSS	Score	Vector	Source
3.1	8.3 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-346 Origin Validation Error
CWE-749 Exposed Dangerous Method or Function
CWE-940 Improper Verification of Source of a Communication Channel

Affected Products

Product	Versions
corehome-assistant	< 2026.4.4Affected
Companion app (iOS)Home Assistant	< 2026.4.1Affected
Companion app (Android)Home Assistant	< 2026.4.4Affected

References

https://github.com/home-assistant/core/security/advisories/GHSA-7jp2-p2fw-mgvf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.