{"affected":[{"product":"n/a","source":"CNA: mitre","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"cveId":"CVE-2026-106714","cwes":[],"description":"Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/<number> path can access the injected nma_petmd_bridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in user's pet profile information after the user opens the crafted link.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793888357445,"publishedAt":1793836800000,"references":[{"source":"CNA: mitre","tags":[],"url":"https://github.com/Siestazzz/myVulnDB/tree/main/Mobile/Chewy_26.23.0"},{"source":"CNA: mitre","tags":[],"url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/Chewy_26.23.0/report.en.md"}],"remediation":[],"revision":"4b162b0e652f189ad0e2fb72e115a651fcbaebb1b7ed7925eeccb4d91b874b4c","sources":[{"modifiedAt":1793888357445,"name":"CNA: mitre","retrievedAt":1793891427971,"url":"https://www.cve.org/CVERecord?id=CVE-2026-106714"}],"ssvc":null,"status":"published","title":"CVE-2026-106714","updatedAt":1793891427971}