A vulnerability in Groww Stock, Mutual Fund, and Gold App up to build 20260805 allows an attacker to manipulate the WebView URL handler that processes custom URL schemes. This improper authorization lets the attacker access or trigger app‑specific actions without proper authentication, leading to potential exposure of sensitive financial data or unauthorized transactions. The weakness is classified as CWE‑285 (Improper Authorization) and CWE‑939 (Use of Untrusted Input).

The issue impacts the Android application for Groww Stock, Mutual Fund, and Gold App and affects any device running a build prior to 20260805. The vulnerability resides in an undocumented portion of the WebView component that handles custom URLs; therefore only the specified product and version range are affected.

The CVSS score of 1 indicates low inherent severity, and the EPSS score is not available, suggesting low exploitation probability. However, the vulnerability is publicly documented and publicly available exploits exist. Based on the description, it is inferred that an attacker would need direct delivery of a crafted URL to the target device, implying that the attack vector is limited to physical device compromise or an already compromised device rather than remote execution. The attack complexity is high and unlocking the system is difficult, meaning that the likelihood of exploitation in the wild is currently low, and the vulnerability is not listed in CISA’s KEV catalog.