Read the docs
TI-2026-32589 Aliases CVE-2026-44698

Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection

Priority LOW 37CWE-346Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-346 and CWE-94.

Summary

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Home Assistant Companion apps for Android and iOS expose a JavaScript bridge to the in-app WebView window.externalApp on Android and webkit.messageHandlers.getExternalAuth (alongside revokeExternalAuth and externalBus) on iOS. Two flaws expose the bridge to all frames (including cross-origin iframes) and unsanitized interpolation of the JavaScript callback identifier allows a cross-origin iframe rendered inside the Companion app to execute arbitrary JavaScript in the Home Assistant frontend's main-frame origin and exfiltrate the signed-in user's access token. This vulnerability is fixed in 2026.4.1 for iOS and 2026.4.4 for Android.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00136 3rd percentileScored 2026-11-07
Fix Fixed core (home-assistant): 2026.4.4Companion app (iOS) (Home Assistant): 2026.4.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
home-assistantcorebefore 2026.4.42026.4.4Patch availableCNA
home-assistantCompanion app (iOS)before 2026.4.12026.4.1Patch availableCNA
home-assistantCompanion app (Android)before 2026.4.42026.4.4Patch availableCNA
  • core Vendorhome-assistant Affected before 2026.4.4 Fixed in 2026.4.4 Patch available CNA
  • Companion app (iOS) Vendorhome-assistant Affected before 2026.4.1 Fixed in 2026.4.1 Patch available CNA
  • Companion app (Android) Vendorhome-assistant Affected before 2026.4.4 Fixed in 2026.4.4 Patch available CNA

Remediation

  • Fix · CNA core (home-assistant) Fixed in 2026.4.4
  • Fix · CNA Companion app (iOS) (Home Assistant) Fixed in 2026.4.1
  • Fix · CNA Companion app (Android) (Home Assistant) Fixed in 2026.4.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44698

References

Other 1

  • TI-2023-12210 Improper authentication in home-assistant core CVSS 3.1CRITICAL 10.0
  • TI-2021-22555 Home Assistant Community Store 1.10.0 Path Traversal Account Takeover CVSS 4.0HIGH 8.7
  • TI-2026-61899 Home Assistant: XSS in Statistics Graph Card CVSS 4.0CRITICAL 9.3
  • TI-2026-46349 Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore CVSS 4.0CRITICAL 9.3
  • TI-2026-40307 Cleartext transmission of sensitive information in home-assistant core CVSS 3.1HIGH 7.5
  • TI-2025-38490 Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name CVSS 4.0HIGH 8.5
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences