The vulnerability originates from insufficient validation of URLs and origins that are loaded within the app’s WebView component. Because the app accepts arbitrary web content, a remote attacker can deliver malicious pages that the WebView renders. This can allow the attacker to perform unauthorized interactions with the app, extract live bearer authentication tokens, impersonate the user, and access vehicle‑related information and services.

The affected products are Tata Motors iRA 2.0 and Tata Motors iRA.ev mobile applications. Versions 26.7.3 and earlier for iRA 2.0, and 26.7.2 and earlier for iRA.ev are vulnerable. The vendors recommend upgrading to iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1.

The CVSS score of 7.1 indicates high severity, but the EPSS score is not available, implying limited publicly known exploitation reports. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remotely delivering malicious content that the app loads into the WebView, such as via phishing URLs or QR codes, which would allow exploitation without direct user interaction beyond opening the link.