CVE-2023-41898

    Dashboard / Vulnerabilities / CVE-2023-41898

    CVE-2023-41898

    Published: 19 Oct 2023Last Modified: 12 Aug 2026

    Summary: Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android

    Details: Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution, and credential theft. This issue has been patched in version 2023.9.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2023-142`.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41898.json, https://github.com/home-assistant/core/security/advisories/GHSA-jvpm-q3hq-86rg, https://nvd.nist.gov/vuln/detail/CVE-2023-41898

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -3568a69101e7a64869aa1ebe26b65597acddae26

    Affected versions

    2023.9.1
    2023.9.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-41898 | CVE-DB