EUVD-2026-36417
GHSA-c3gw-qw4g-hx8g
Severity by source
CVSS:4.0/AV:P/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical access required and high complexity per description; low privileges needed; only low integrity impact with no confidentiality or availability compromise confirmed.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in Groww Stock, Mutual Fund, Gold App up to 20260805 on Android. This affects an unknown part of the component WebView URL Handler. The manipulation leads to improper authorization in handler for custom url scheme. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
AnalysisAI
Improper authorization in the WebView URL Handler of the Groww Stock, Mutual Fund, Gold App for Android (all versions up to build 20260805) allows a low-privileged attacker with physical device access to invoke custom URL scheme handlers without proper authorization, enabling unauthorized in-app navigation or bypass of client-side access controls. The CVSS 4.0 score of 0.3 reflects severe exploitation constraints: physical access is mandatory, attack complexity is high, and impact is limited to low integrity compromise with no confirmed confidentiality exposure. A public proof-of-concept is available on GitHub and Google Drive; the vulnerability is not listed in CISA KEV and no vendor patch has been confirmed at time of analysis.
Technical ContextAI
The Groww app (CPE: cpe:2.3:a:groww:stock,_mutual_fund,_gold_app) renders content via Android WebView and registers custom URL scheme handlers (e.g., groww://) for in-app deep-linking and navigation. CWE-939 (Improper Authorization in Handler for Custom URL Scheme) captures the failure to validate whether an invoking context is authorized to trigger these scheme handlers. On Android, when a WebView does not enforce origin or caller restrictions on custom scheme resolution, a crafted URL loaded within or directed at the WebView can invoke privileged app functionality - such as navigating to authenticated screens or bypassing client-side app-lock enforcement - without satisfying the intended authorization gate. The GitHub POC title ('Unsafe WebView URL Handling - Weak Client-Side App Lock Enforcement') corroborates this: the root cause is insufficient validation of who or what is permitted to invoke the custom scheme handler, compounded by client-side (rather than server-side) enforcement of access controls.
RemediationAI
No vendor-released patch has been identified at time of analysis. Users should monitor the official Groww app listing on the Google Play Store and apply any available update immediately, as the vendor was contacted prior to disclosure and a fix may follow. As a compensating control for users in elevated-risk environments, enforcing strong device-level screen lock (PIN or biometric) directly limits the physical-access attack vector since an attacker cannot reach the WebView handler without first unlocking the device - the trade-off is no change to app functionality. Organizations managing Android fleets via MDM/EMM (e.g., Jamf, Microsoft Intune) can push restrictions on WebView-based URL scheme invocation or enforce app-level authentication policies; consult your MDM vendor for specific capability. The public POC and technical detail are available at https://github.com/honestcorrupt/Groww-Android-Application-Unsafe-WebView-URL-Handling-Weak-Client-Side-App-Lock-Enforcement.git and the VulDB submission at https://vuldb.com/submit/822984 for defenders who need to reproduce or verify the behavior.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today