Loading arbitrary external URLs through WebView components enables malicious JavaScript to be executed inside the app. The injected script can capture user tokens that the application stores or transmits, leading to a serious confidentiality breach. The weakness arises from insufficient input validation when creating the WebView URL, which is a classic instance of CWE-20: Improper Input Validation.

The product affected is OPPO Health, a mobile application distributed by OPPO. No specific version numbers are listed in the advisory; the issue applies to any currently shipped version that allows external URLs to be loaded through its WebView component.

The CVSS score of 8.3 indicates high severity. The EPSS score is not available, so the current exploitation probability cannot be quantified, but the fact that the vulnerability can be triggered via a WebView suggests that it could be exercised in the field. The vulnerability is not listed in the CISA KEV catalog. Attackers likely need to lure a user into visiting a crafted link or otherwise trick the device into loading a malicious URL within the app – a scenario that could be achieved via phishing, compromised content or malicious app extensions.