Read the docs
TI-2026-85460 Aliases CVE-2026-106714GHSA-p7ff-33g6-pww5

Chewy for Android leaks pet profiles through a crafted deep link

Priority LOW 22Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
No fix listed

No CVSS vector from any source. Fix status from CNA.

Summary

Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page can reach an injected JavaScript interface and call getPetProfiles, which discloses a signed-in user's pet profile information if the user opens the crafted link.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/<number> path can access the injected nma_petmd_bridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in user's pet profile information after the user opens the crafted link.

Why it matters now

EPSS 0.00156 4th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Chewy for Android.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-106714
  2. 2026-11-05 Alias added: GHSA-p7ff-33g6-pww5
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences