The Chewy Android application uses a Hybrid WebView to render product‑detail pages but does not validate the host of URLs fed through product‑details deep links. An attacker can craft a link to a malicious site containing a "/dp/<number>" path. When the user opens this link, the WebView loads the attacker’s content and the nma_petmd_bridge JavaScript interface becomes accessible, allowing the attacker to invoke getPetProfiles and retrieve the signed‑in user’s pet profile information. This leakage exposes personal data such as pet names, breeds, and health details.

The flaw exists in Chewy Android app version 26.23.0. All installations of this version that permit external deep links are affected; no other product versions are indicated as vulnerable.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score is less than 1%, suggesting a very low probability of exploitation. The vulnerability requires only that a user click a crafted link, after which sensitive data is disclosed. Although not listed in the CISA KEV catalog, the nature of the flaw presents a moderate to high risk for users who interact with malicious deep links, especially where host validation is absent.