Skip to content
CVE PROGRAM SOURCE RECORD8.3 High

CVE-2025-27388

Arbitrary URL Loading in WebView Leading to Token Leakage Risk

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
OPPO

Description

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OPPO OPPO HEALTH APP

Default version status: unaffected

  • 4.23.4 and below to ≤ 4.23.4affected

References