CVE-2026-22072

DiscoveredAug 17, 2026UpdatedSep 3, 2026

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.

CVSS v3.1

—

EPSS

0.43%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Aug 18, 2026 → Sep 25, 2026

▲ 0.17pp

0.25% → 0.43% over 2 tracked changes

Connections

1 relationships

Timeline

disclosure → media coverage

Aug 17, 2026

Disclosure — published as a CVE record. · last revised by NVD Sep 3, 2026