Description
Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OPPO | OPPO Health | — | — |
High · 8.3
CVE-2026-22072
EUVD-2026-60058GHSA-96vw-w9m3-gj89
Arbitrary URL Loading in WebView Leading to Token Leakage Risk
Published Aug 17, 2026 · Updated Aug 17, 2026 · Assigned by OPPO