Description
NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. An attacker can supply such a page through the newsbreak://openweb deep link and invoke NBJS.callNative with the getLoginInfo action, disclosing a signed-in user's account information and session token after the user opens the crafted link.
Published: 2026-11-05
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Update App
AI Analysis

Impact

NewsBreak for Android version 26.21.0 accepts data:text/html URLs as trusted in its WebView JavaScript bridge origin check. An attacker can craft a link using the newsbreak://openweb deep link, delivering a data:text/html page that calls NBJS.callNative with the getLoginInfo action. When a user opens this link, the app processes the call and returns the current signed‑in user’s account information and session token, leaking credentials and session data.

Affected Systems

This vulnerability affects the NewsBreak Android application, specifically version 26.21.0. No other versions are confirmed vulnerable in the provided information.

Risk and Exploitability

The CVSS score is 6.5, but the ability to obtain a user’s credentials and session token after a user interacts with a crafted link poses a high risk to confidentiality. The exploit requires the victim to click a deep link, so social engineering is a prerequisite. Because the EPSS score is 0.00156 and the vulnerability is not listed in the CISA KEV catalog, the likelihood of widespread exploitation is currently unknown, yet the impact remains significant for any impacted user.

Generated by OpenCVE AI on November 6, 2026 at 15:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest NewsBreak Android version, where the origin check for WebView URLs has been corrected.
  • If an immediate upgrade is not possible, add a device‑level restriction to block the newsbreak://openweb schema from untrusted sources and inform users not to click unknown deep links.
  • Contact NewsBreak support to confirm the fix and obtain a patch if one has not been released yet.

Generated by OpenCVE AI on November 6, 2026 at 15:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-640

Fri, 06 Nov 2026 12:15:00 +0000

Type Values Removed Values Added
Title NewsBreak Android App Data URI Exploit Reveals Login Credentials NewsBreak: NewsBreak: Information disclosure via improper WebView origin check
Weaknesses CWE-346
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

threat_severity

Moderate

Thu, 05 Nov 2026 15:45:00 +0000

Type Values Removed Values Added
Title NewsBreak Android App Data URI Exploit Reveals Login Credentials
Weaknesses CWE-640

Thu, 05 Nov 2026 14:30:00 +0000

Type Values Removed Values Added
Description NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. An attacker can supply such a page through the newsbreak://openweb deep link and invoke NBJS.callNative with the getLoginInfo action, disclosing a signed-in user's account information and session token after the user opens the crafted link.
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-11-05T14:20:55.235Z

Reserved: 2026-10-07T00:00:00.000Z

Link: CVE-2026-106715

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-05T15:17:16.900

Modified: 2026-11-05T15:17:16.900

Link: CVE-2026-106715

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-11-05T00:00:00Z

Links: CVE-2026-106715 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T16:00:08Z

Weaknesses