CVE-2026-22072CWE-20

CVE-2026-22072

published August 17, 2026

CVSS
8.3
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.

The record
Technical detail
CVSS
8.3 · NONE
CVSS v4.0
8.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N
EPSS
0.00428 · 36.0th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-08-17T11:17Z
References (1)
https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2088198578949595136 · [email protected]
EPSS history
Timeline
  • 17 AUG 06:13Z
    Arbitrary URL Loading in WebView Leading to Token Leakage Risk
    cvelistv5