CVE-2026-44698

nvd.nist.gov • June 1, 2026

Assistant is open source automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Assistant Companion apps for Android and iOS expose a JavaScript bridge to the in-app WebView window.externalApp on Android and webkit.messageHandlers.getExternalAuth (alongside revokeExternalAuth and externalBus) on iOS. Two flaws expose the bridge to all frames (including cross-origin iframes) and unsanitized interpolation of the JavaScript callback identifier allows a cross-origin iframe rendered inside the Companion app to execute arbitrary JavaScript in the Assistant frontend's main-frame origin and exfiltrate the signed-in user's access token. This vulnerability is fixed in 2026.4.1 for iOS and 2026.4.4 for Android.

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address this page to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerability in Home Assistant Apps Allows User Takeover A security vulnerability in the Home Assistant companion apps for Android and iOS allows attackers to intercept access tokens, enabling full control over user instances. The flaw, identified as CVE-2026-44698, has a CVSS score of 8.3, indicating a high risk. Attackers can exploit this vulnerability through Cross-Origin IFrame Token Exfiltration via JavaScript, where a malicious iframe can execute arbitrary code and extract the logged-in user's access token. Users of the affected apps are advised to update to versions 2026.4.1 for iOS and 2026.4.4 for Android to mitigate the risk. If unable to update, users should remove any webpage cards from their dashboards that link to third-party sites. The vulnerability was publicly disclosed on May 29, 2026, following a security advisory from the developers. 1 sources 72

Extracted Entities

CVE-2026-44698

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (2)

MITRE ATT&CK (3)

Platforms (2)