CVE-2026-44698: Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection

Synopsis

This is a cross-origin JavaScript bridge injection flaw in the Home Assistant Companion apps for iOS and Android. The bridge is reachable over the network when a user is lured into loading a malicious page inside the in-app WebView, and because the bridge is exposed to all frames and interpolates a callback identifier without sanitization, a cross-origin iframe can execute arbitrary JavaScript in the Home Assistant frontend origin and steal the signed-in user's access token. A patched-image rebuild at Companion 2026.4.1 (iOS) / 2026.4.4 (Android) and Home Assistant core 2026.4.4 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must get the victim's Companion app WebView to load attacker-controlled content over the network, typically via a malicious page or embedded iframe.

• AuthenticationNot required

  PR:N: the attacker needs no account on the target Home Assistant instance to trigger the bridge.

• Victim interactionRequired

  UI:R: a signed-in user must open or be navigated to attacker-controlled content inside the Companion app's in-app WebView.

• Attack complexityDetail

  AC:H: exploitation depends on getting a cross-origin iframe rendered inside the Companion WebView while the user is authenticated, which requires some setup beyond a single click.

Blast Radius

• Reads the signed-in user's Home Assistant access token from the frontend origin, granting full API access as that user.
• Executes arbitrary JavaScript in the Home Assistant frontend's main-frame origin, enabling tampering with the UI and issuing authenticated backend calls.
• With a stolen token, an attacker can control connected devices, modify automations, and disrupt availability of the Home Assistant deployment.