CVE-2026-44698Patch

LOWCVSS 8.3 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Home Assistant Companion apps for Android and iOS expose a JavaScript bridge to the in-app WebView window.externalApp on Android and webkit.messageHandlers.getExternalAuth (alongside revokeExternalAuth and externalBus) on iOS. Two flaws expose the bridge to all frames (including cross-origin iframes) and unsanitized interpolation of the JavaScript callback identifier allows a cross-origin iframe rendered inside the Companion app to execute arbitrary JavaScript in the Home Assistant frontend's main-frame origin and exfiltrate the signed-in user's access token. This vulnerability is fixed in 2026.4.1 for iOS and 2026.4.4 for Android.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://github.com/home-assistant/core/security/advisories/GHSA-7jp2-p2fw-mgvf

Weakness type (CWE)

CWE-94CWE-346CWE-749CWE-940

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 1 signal
Peaked 1d ago at 1 mentions (2026-06-01); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Patch

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

ThreatCluster@threatcluster137d
Patch
BREAKING: CVE-2026-44698 in Home Assistant Android and iOS apps lets attackers steal access tokens for full instance takeover, fixed in iOS 2026.4.1 and Android 2026.4.4. https://threatcluster.io/cluster/critical-vulnerability-in-home-assistant-apps-allows-user-ta-958cbc98
Post summary
A newly disclosed CVE-2026-44698 in Home Assistant Android and iOS apps permits attackers to steal access tokens for full instance takeover, with patches released in iOS 2026.4.1 and Android 2026.4.4.
0001062
291 followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker121d
Patch
CVE-2026-44698 Home Assistant Companionアプリ（iOS 2026.4.1以前、Android 2026.4.4以前）の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/13/cve-2026-44698-home-assistant-companionios-202641android-202644/ #IT #Security #cybersecurity
Post summary
The blog post offers an overview of the CVE-2026-44698 vulnerability in the Home Assistant Companion app and summarizes the affected iOS/Android versions along with recommended mitigations.
0000059
209 followersView on X

Explore more

Back to dashboard