# CVE-2026-44698: Home Assistant Companion apps token exfiltration via WebView bridge

Source: https://junglewise.ai/threats/cve-2026-44698-home-assistant-companion-apps-token-exfiltration-via-webview  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-44698 · Severity: high · CVSS 8.3 · Published 2026-05-29

Home Assistant is a popular smart home automation platform. A security flaw in its mobile apps for Android and iOS allows a malicious website, if loaded inside a dashboard 'Webpage' card, to steal the user's login token. This could allow an attacker to remotely control the victim's smart home devices, access camera feeds, or lock/unlock doors without the user's knowledge.

Vendors: [Home Assistant](https://junglewise.ai/threats/vendors/home-assistant).

## Quick answers

**Is CVE-2026-44698 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44698 being exploited in the wild.

**How severe is CVE-2026-44698?** High severity, with a CVSS score of 8.3, published 29 May 2026.

**Which products and versions are affected?** Home Assistant Companion (Android) < 2026.4.4; Home Assistant Companion (iOS) < 2026.4.1.

**Is there a fix for CVE-2026-44698?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44698 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44698?** Check whether you run Home Assistant Companion (Android) or Home Assistant Companion (iOS) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Home Assistant Companion apps for Android and iOS expose a JavaScript bridge (window.externalApp on Android and webkit.messageHandlers on iOS) to the in-app WebView. Two primary flaws exist: first, the bridge is exposed to all frames including cross-origin iframes; second, the apps perform unsanitized interpolation of the 'callback' identifier in the getExternalAuth and revokeExternalAuth methods. An attacker can use a 'Webpage' card to load a malicious iframe that supplies an Immediately Invoked Function Expression (IIFE) as a callback. This code is then executed via evaluateJavascript() in the context of the main Home Assistant frontend origin, allowing the attacker to exfiltrate the OAuth 2.0 bearer token. The vulnerability also allows for a denial-of-service by remotely revoking the user's session. Fixes are available in Android version 2026.4.4 and iOS version 2026.4.1.

## Affected products

- Home Assistant Home Assistant Companion (Android) < 2026.4.4
- Home Assistant Home Assistant Companion (iOS) < 2026.4.1

## Timeline

- 2026-05-11: advisory: GitHub Security Advisory published
- 2026-05-29: disclosed: CVE published to NVD

## References

- [https://github.com/home-assistant/core/security/advisories/GHSA-7jp2-p2fw-mgvf](https://github.com/home-assistant/core/security/advisories/GHSA-7jp2-p2fw-mgvf)