PT-2026-44845 · Home Assistant · Home Assistant Companion App For Ios+1

Kwstubbs · Published 2026-05-29 · Updated 2026-06-01 · CVE-2026-44698

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Home Assistant Companion app for iOS versions prior to 2026.4.1 Home Assistant Companion app for Android versions prior to 2026.4.4

Description The Home Assistant Companion apps for Android and iOS expose a JavaScript bridge to the in-app WebView. On Android, this is via 'window.externalApp', and on iOS, it is via 'webkit.messageHandlers.getExternalAuth', 'revokeExternalAuth', and 'externalBus'. Two flaws allow this bridge to be accessed by all frames, including cross-origin iframes. Additionally, unsanitized interpolation of the JavaScript callback identifier enables a cross-origin iframe rendered within the app to execute arbitrary JavaScript in the main-frame origin of the Home Assistant frontend, which can be used to exfiltrate the signed-in user's access token.

Recommendations Update the iOS app to version 2026.4.1. Update the Android app to version 2026.4.4.

Fix

Origin Validation Error

Code Injection

Weakness Enumeration

CWE-346

CWE-940

CWE-749

CWE-94

Related Identifiers

CVE-2026-44698

Affected Products

Home Assistant Companion For Android

Home Assistant Companion App For Ios

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-44698 · Security Note
• https://github.com/home-assistant/core/security/advisories/GHSA-7jp2-p2fw-mgvf · Note
• https://t.me/CVEtracker/55261 · Telegram Post
• https://twitter.com/threatcluster/status/2061478181362683940 · Twitter Post