PT-2026-48865 · Groww · Groww

Honest_Corrupt · CVE-2026-12065 · Published 2026-06-12 · Updated 2026-06-12

Positive Technologies (AI Summary)

CVSS v3.1

1.8

Low

Base vector

AV:P/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Groww Stock, Mutual Fund, Gold App versions prior to 20260805

Description An issue exists in the WebView URL Handler component on Android. The manipulation of the handler for custom URL schemes leads to improper authorization. This attack can be launched on a physical device, although the complexity is high and exploitability is difficult.

Recommendations Update to a version later than 20260805.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

CWE-939

Related Identifiers

CVE-2026-12065

Affected Products

Groww

References · 10

• 🔥 https://drive.google.com/drive/folders/1r9t4AuG747PmRbgLmY2CztsX5PTjQL19 · Exploit
• 🔥 https://github.com/honestcorrupt/CVE-req-Groww-Android-Application-Unsafe-WebView-URL-Handling-Weak-Client-Side-App-Lock-Enforcement · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-12065 · Security Note
• ❌ https://github.com/honestcorrupt/Groww-Android-Application-Unsafe-WebView-URL-Handling-Weak-Client-Side-App-Lock-Enforcement.git · Note, Deleted
• https://vuldb.com/vuln/370560/cti · Note
• https://twitter.com/VulmonFeeds/status/2065540029162639614 · Twitter Post
• https://vuldb.com/vuln/370560 · Note
• https://vuldb.com/submit/822984 · Note
• https://vuldb.com/cve/CVE-2026-12065 · Note
• https://twitter.com/CVEnew/status/2065461506121056427 · Twitter Post