Home Assistant Companion EUVD-2026-33317

Exploitation requires the victim to open content inside the Home Assistant Companion app's WebView that loads an attacker-controlled cross-origin iframe - typically via an iframe card, webpage card, or other custom Lovelace resource pointing at attacker content, or a link clicked from within the app - and the device must be running a vulnerable Companion App version (iOS < 2026.4.1 or Android < 2026.4.4) with the user already signed in so a valid access token exists to steal. Limiting factors per CVSS AV:N/AC:H/PR:N/UI:R: no authentication to the attacker's content is needed, but high attack complexity reflects the need to get the malicious iframe rendered in the Companion WebView specifically (not the system browser, where the bridge is absent), and user interaction is required to load the trigger dashboard or link; desktop/browser-only users of Home Assistant are not affected.

CVSS 8.3 (High) is driven by Scope:Changed plus full CIA impact, reflecting the fact that an untrusted iframe origin can pivot into the Home Assistant frontend origin and exfiltrate long-lived access tokens - a token theft outcome with material downstream risk for smart-home control. However, attack complexity is High (AC:H) and user interaction is required (UI:R): exploitation depends on the victim using the Companion app to navigate to, or render content from, an attacker-controlled page that loads a malicious iframe, and on the Lovelace/dashboard configuration permitting such embedding. EPSS and CISA KEV status are not provided in the input, and no public POC is referenced, so this should currently be treated as a credible high-severity client-side issue rather than a mass-exploitation event - patch promptly, but it is not on par with an unauthenticated server-side RCE. The CWE-94 classification is appropriate; the network attack vector is consistent with the description because the malicious frame is delivered over the network into a WebView.

A Home Assistant user opens a dashboard inside the Companion app that contains (or is tricked via a link/notification into loading) an attacker-controlled webpage or iframe card. The malicious frame calls the exposed bridge (window.externalApp.getExternalAuth on Android or webkit.messageHandlers.getExternalAuth on iOS) with a poisoned callback identifier that, when interpolated back into the main frame, executes attacker JavaScript in the Home Assistant frontend origin and POSTs the user's access token to an external server. No public POC is referenced.