High severity8.6NVD Advisory· Published Oct 19, 2023· Updated Jun 17, 2026
CVE-2023-41898
CVE-2023-41898
Description
Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution, and credential theft. This issue has been patched in version 2023.9.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: GHSL-2023-142.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4- cpe:2.3:a:home-assistant:home_assistant_companion:*:*:*:*:*:android:*:*Range: <2023.9.2
- Range: <=2023.8.2
- Range: <=2023.8.2
Patches
Vulnerability mechanics
References
1- github.com/home-assistant/core/security/advisories/GHSA-jvpm-q3hq-86rgnvdVendor Advisory
News mentions
0No linked articles in our index yet.