The vulnerability arises when the Home Assistant Companion apps expose a JavaScript bridge to the in‑app WebView. The bridge is accessible to all frames, including cross‑origin iframes, and injects the callback identifier without sanitization. An attacker can host a malicious iframe inside the app, causing the injected JavaScript to execute in the main‑frame origin and steal the signed‑in user’s access token. This enables an attacker to impersonate the user without needing credentials and to gain full control over the user’s Home Assistant instance.

Affected vendors are Home Assistant Companion app for Android versions earlier than 2026.4.4 and for iOS earlier than 2026.4.1, as well as the home‑assistant core (though the core itself is not directly implicated). Updating to the fixed releases eliminates the flaw.

The CVSS score of 8.3 indicates a high severity weakness. While no EPSS score is publicly available and the vulnerability is not listed in CISA KEV, the likelihood of exploitation depends on an attacker’s ability to serve malicious content within a cross‑origin iframe inside the Companion app. Given the nature of the flaw—unsanitized execution of JavaScript—the attack can be carried out from within the app without additional user interaction, making it a potentially feasible local or remote attack vector.