Code Injection in CVE-2026-44698 (CVSS 8.3)

Summary

code injection in CVE-2026-44698 (CVE-2026-44698). Successful exploitation can lead to full system takeover. Exploitable via window.externalApp. Mitigation: upgrade to 2026.4.1 or later.

Original description

The description as published by the source.

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Home Assistant Companion apps for Android and iOS expose a JavaScript bridge to the in-app WebView window.externalApp on Android and webkit.messageHandlers.getExternalAuth (alongside revokeExternalAuth and externalBus) on iOS. Two flaws expose the bridge to all frames (including cross-origin iframes) and unsanitized interpolation of the JavaScript callback identifier allows a cross-origin iframe rendered inside the Companion app to execute arbitrary JavaScript in the Home Assistant frontend's main-frame origin and exfiltrate the signed-in user's access token. This vulnerability is fixed in 2026.4.1 for iOS and 2026.4.4 for Android.

Source: NIST National Vulnerability Database NVD

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

A vulnerability tracked as CVE-2026-44698 has been found in CVE-2026-44698.
Attackers can target a specific entry point like window.externalApp over the network to misuse the product.
Successful exploitation can lead to full system takeover. CVSS score: 8.3/10.
What to do: upgrade CVE-2026-44698 to 2026.4.1 or later.
If unsure, ask your IT team or search "CVE-2026-44698 CVE-2026-44698" on the vendor's site.

CVE-2026-44698 (CVE-2026-44698) — CWE-94 / CVSS v3 8.3
Attack vector: remote (network-reachable) / unauthenticated
Attack surface: window.externalApp / webkit.messageHandlers.getExternalAuth / revokeExternalAuth / externalBus
Affected: <2026.4.1
Patched: 2026.4.1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

Home Assistant CompanionアプリでのJavaScriptブリッジの不適切なフレーム露出とコールバック識別子の検証不足により、任意のJavaScriptが実行される可能性がある。

📍 Affected scope

AndroidおよびiOS用Home Assistant Companionアプリのバージョン2026.4.1以前のiOS版と2026.4.4以前のAndroid版。

🔥 Severity

高レベルの深刻度で、アクセス・トークンの漏洩につながる恐れがある。

🔧 How to fix

iOS版を2026.4.1に、Android版を2026.4.4にアップデートする。

🛡️ Workaround

情報なし

🔍 Detection

ユーザーのアクセス・トークンが予期せず漏洩していないことを確認する。

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
Audit SBOM/dependencies for affected components.
```
依存マニフェストで影響コンポーネントを特定する。
2
Match against affected range verify
```
Confirm if version satisfies `<2026.4.1`
```
Step 1 で見つかったバージョンが影響範囲 <2026.4.1 に該当するか照合。本番で稼働中ならインシデント扱い。
6
Apply patch patch
```
Upgrade to 2026.4.1
```
ステージング環境で 2026.4.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスと、Step 3 で見つけた異常検知の続報チェックを含めること。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

References

web security-advisories@github.com