PT-2026-28467 · Google+1 · Android Auto+1

Pwnpanda · Published 2026-03-27 · Updated 2026-03-29 · CVE-2026-33045

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Home Assistant versions 2025.02 through 2026.01

Description The "remaining charge time" sensor for mobile phones (imported from Android Auto) in Home Assistant is susceptible to cross-site scripting (XSS). This issue is similar to CVE-2025-62172. The History-graph card displays the name of the entity without proper output escaping or sanitization, allowing for the injection of arbitrary tags, including JavaScript. A malicious actor can exploit this by changing the name of the sensor to include a malicious payload, which is then executed when a user hovers over the graph. The impact of this vulnerability could allow an attacker to perform account takeover. The vulnerability appears to rely on the use of Android Auto, but may also be triggered by other devices with the same sensor.

Recommendations Update to version 2026.01 or later to resolve this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33045

GHSA-46J8-VPX8-6P72

Affected Products

Android Auto

Home Assistant

References · 7

• 🔥 https://github.com/home-assistant/core/security/advisories/GHSA-46j8-vpx8-6p72 · Exploit
• https://github.com/home-assistant/core/security/advisories/GHSA-mq77-rv97-285m · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-46j8-vpx8-6p72 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33045 · Security Note
• https://github.com/home-assistant/core · Note
• https://reddit.com/r/VulnMatter/comments/1s6lazl/resumen_diario_de_vulnerabilidades_29032026 · Reddit Post
• https://twitter.com/CVEnew/status/2037719417090662481 · Twitter Post