Executive brief
Home Assistant is a popular smart home automation platform. A security flaw in its mobile apps for Android and iOS allows a malicious website, if loaded inside a dashboard 'Webpage' card, to steal the user's login token. This could allow an attacker to remotely control the victim's smart home devices, access camera feeds, or lock/unlock doors without the user's knowledge.
Technical details
The Home Assistant Companion apps for Android and iOS expose a JavaScript bridge (window.externalApp on Android and webkit.messageHandlers on iOS) to the in-app WebView. Two primary flaws exist: first, the bridge is exposed to all frames including cross-origin iframes; second, the apps perform unsanitized interpolation of the 'callback' identifier in the getExternalAuth and revokeExternalAuth methods. An attacker can use a 'Webpage' card to load a malicious iframe that supplies an Immediately Invoked Function Expression (IIFE) as a callback. This code is then executed via evaluateJavascript() in the context of the main Home Assistant frontend origin, allowing the attacker to exfiltrate the OAuth 2.0 bearer token. The vulnerability also allows for a denial-of-service by remotely revoking the user's session. Fixes are available in Android version 2026.4.4 and iOS version 2026.4.1.
Affected products
- Home Assistant Home Assistant Companion (Android) < 2026.4.4
- Home Assistant Home Assistant Companion (iOS) < 2026.4.1
Timeline
- 2026-05-11: advisory: GitHub Security Advisory published
- 2026-05-29: disclosed: CVE published to NVD