Description
Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OPPO | OPPO HEALTH APP | — | — |
High · 8.3
CVE-2025-27388
EUVD-2025-24672GHSA-p7fx-m2v4-mhhw
Arbitrary URL Loading in WebView Leading to Token Leakage Risk
Published Aug 14, 2025 · Updated Aug 14, 2025 · Assigned by OPPO