CVE-2025-27388CWE-20

Arbitrary URL Loading in WebView Leading to Token Leakage Risk

High · published August 14, 2025

CVSS v4.0
8.3
EPSS
0%
Percentile
31.4
In the wild
Unconfirmed
What it is

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.

The record
Technical detail
CVSS v4.0
8.3 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N
EPSS
0.00385 · 31.4th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-08-14T07:15Z
EPSS history
Timeline
  • 14 AUG 07:15Z
    Arbitrary URL Loading in WebView Leading to Token Leakage Risk
    cvelistv5