CVE-2026-12065

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12065", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-06-12T07:32:56.280Z", "datePublished": "2026-06-12T12:30:08.900Z", "dateUpdated": "2026-06-12T15:19:01.719Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-12T12:30:08.900Z"}, "title": "Groww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url scheme", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-939", "lang": "en", "description": "Improper Authorization in Handler for Custom URL Scheme"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}], "affected": [{"vendor": "Groww", "product": "Stock, Mutual Fund, Gold App", "versions": [{"version": "20260805", "status": "affected"}], "cpes": ["cpe:2.3:a:groww:stock_mutual_fund_gold_app:*:*:*:*:*:*:*:*"], "modules": ["WebView URL Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Groww Stock, Mutual Fund, Gold App up to 20260805 on Android. This affects an unknown part of the component WebView URL Handler. The manipulation leads to improper authorization in handler for custom url scheme. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 1, "vectorString": "CVSS:4.0/AV:P/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 1.8, "vectorString": "CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 1.8, "vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1, "vectorString": "AV:L/AC:H/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-06-12T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-06-12T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-06-12T09:38:15.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "honest_corrupt (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/370560", "name": "VDB-370560 | Groww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url scheme", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/370560/cti", "name": "VDB-370560 | CTI Indicators (IOB, IOC)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-12065", "name": "CVE-2026-12065 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/822984", "name": "Submit #822984 | Groww Groww Android Application Latest Available Version Weak Client-Side Protection and Unsafe WebView URL Handling", "tags": ["third-party-advisory"]}, {"url": "https://github.com/honestcorrupt/Groww-Android-Application-Unsafe-WebView-URL-Handling-Weak-Client-Side-App-Lock-Enforcement.git", "tags": ["related"]}, {"url": "https://drive.google.com/drive/folders/1r9t4AuG747PmRbgLmY2CztsX5PTjQL19", "tags": ["exploit"]}]}, "adp": [{"references": [{"url": "https://github.com/honestcorrupt/CVE-req-Groww-Android-Application-Unsafe-WebView-URL-Handling-Weak-Client-Side-App-Lock-Enforcement", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-12T15:18:03.541331Z", "id": "CVE-2026-12065", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-12T15:19:01.719Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12065", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-12T15:18:03.541331Z"}}}], "references": [{"url": "https://github.com/honestcorrupt/CVE-req-Groww-Android-Application-Unsafe-WebView-URL-Handling-Weak-Client-Side-App-Lock-Enforcement", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-12T15:17:43.346Z"}}], "cna": {"title": "Groww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url scheme", "credits": [{"lang": "en", "type": "reporter", "value": "honest_corrupt (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 1, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:P/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 1.8, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 1.8, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1, "vectorString": "AV:L/AC:H/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:groww:stock_mutual_fund_gold_app:*:*:*:*:*:*:*:*"], "vendor": "Groww", "modules": ["WebView URL Handler"], "product": "Stock, Mutual Fund, Gold App", "versions": [{"status": "affected", "version": "20260805"}]}], "timeline": [{"lang": "en", "time": "2026-06-12T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-06-12T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-06-12T09:38:15.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/370560", "name": "VDB-370560 | Groww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url scheme", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/370560/cti", "name": "VDB-370560 | CTI Indicators (IOB, IOC)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-12065", "name": "CVE-2026-12065 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/822984", "name": "Submit #822984 | Groww Groww Android Application Latest Available Version Weak Client-Side Protection and Unsafe WebView URL Handling", "tags": ["third-party-advisory"]}, {"url": "https://github.com/honestcorrupt/Groww-Android-Application-Unsafe-WebView-URL-Handling-Weak-Client-Side-App-Lock-Enforcement.git", "tags": ["related"]}, {"url": "https://drive.google.com/drive/folders/1r9t4AuG747PmRbgLmY2CztsX5PTjQL19", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Groww Stock, Mutual Fund, Gold App up to 20260805 on Android. This affects an unknown part of the component WebView URL Handler. The manipulation leads to improper authorization in handler for custom url scheme. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-939", "description": "Improper Authorization in Handler for Custom URL Scheme"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "Improper Authorization"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-12T12:30:08.900Z"}}}, "cveMetadata": {"cveId": "CVE-2026-12065", "state": "PUBLISHED", "dateUpdated": "2026-06-12T15:19:01.719Z", "dateReserved": "2026-06-12T07:32:56.280Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-06-12T12:30:08.900Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:groww:stock_mutual_fund_gold_app:*:*:*:*:*:*:*:*"], "modules": ["WebView URL Handler"], "product": "Stock, Mutual Fund, Gold App", "vendor": "Groww", "versions": [{"status": "affected", "version": "20260805"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Groww Stock, Mutual Fund, Gold App up to 20260805 on Android. This affects an unknown part of the component WebView URL Handler. The manipulation leads to improper authorization in handler for custom url scheme. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad en la aplicaci\u00f3n Groww Stock, Mutual Fund, Gold hasta la versi\u00f3n 20260805 en Android. Esto afecta una parte desconocida del componente Gestor de URL de WebView. La manipulaci\u00f3n conduce a una autorizaci\u00f3n indebida en el gestor para el esquema de URL personalizado. Es posible lanzar el ataque en el dispositivo f\u00edsico. La complejidad de un ataque es bastante alta. Se indica que la explotabilidad es dif\u00edcil. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado. Se contact\u00f3 al proveedor con antelaci\u00f3n sobre esta divulgaci\u00f3n."}], "id": "CVE-2026-12065", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 1.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:H/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 1.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 1.8, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.4, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "PHYSICAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 0.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12065", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-12T15:18:03.541331Z", "version": "2.0.3"}}]}, "published": "2026-06-12T14:16:30.413", "references": [{"source": "cna@vuldb.com", "url": "https://drive.google.com/drive/folders/1r9t4AuG747PmRbgLmY2CztsX5PTjQL19"}, {"source": "cna@vuldb.com", "url": "https://github.com/honestcorrupt/Groww-Android-Application-Unsafe-WebView-URL-Handling-Weak-Client-Side-App-Lock-Enforcement.git"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-12065"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/822984"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/370560"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/370560/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/honestcorrupt/CVE-req-Groww-Android-Application-Unsafe-WebView-URL-Handling-Weak-Client-Side-App-Lock-Enforcement"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-939"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260805"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 97.0, "source": "matching"}]}, "original": {"product": "Stock, Mutual Fund, Gold App", "source": "cna", "vendor": "Groww"}, "product": "stock_mutual_fund_gold_app", "vendor": "groww"}], "created": "2026-06-12T15:30:31.808355+00:00", "updated": "2026-06-12T20:00:17.783262+00:00", "vendors": ["groww", "groww$PRODUCT$stock_mutual_fund_gold_app"]}