EUVD-2026-42635
GHSA-g8qr-vqpc-qjpw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H because exploitation requires an SSL-bypass/MITM position; UI:R for required user interaction; S:C and high C/I/A reflect the WebView sandbox escape to device-level actions.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
3DescriptionCVE.org
When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app. The injection of specific JavaScript function calls allows the attacker to escape the WebView sandbox and perform a number of dangerous actions on the user's device.
AnalysisAI
WebView sandbox escape in the PayRange 7.0.7 mobile payment app allows a network attacker to inject arbitrary JavaScript into the app's embedded WebView when chained with a separate SSL/TLS bypass, then invoke privileged JavaScript-to-native function calls to break out of the sandbox and perform dangerous actions on the victim's device. Affected users are those running PayRange 7.0.7 who can be induced to open attacker-influenced content while an attacker holds a man-in-the-middle position. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), indicating no observed mass exploitation despite the 9.6 CVSS rating; the issue is documented in CERT/CC VU#152953.
Technical ContextAI
PayRange is a mobile app that lets consumers pay for unattended retail machines (laundromats, vending, car washes) via their phone. The flaw lives in the app's use of an embedded WebView - a browser component that renders web content inside a native app and often exposes native functionality to JavaScript through a bridge interface. The referenced weakness is CWE-94 (Improper Control of Generation of Code / code injection): because TLS validation can be bypassed, an attacker-controlled response can deliver JavaScript that the WebView executes, and specific exposed JavaScript function calls let that code cross the WebView-to-native boundary. This is a classic two-bug chain where a transport-security failure (the SSL bypass) enables the injection, and an over-permissive JavaScript bridge turns injection into device-level actions.
RemediationAI
No vendor-released patched version is identified in the available data, so a specific fix version cannot be cited; monitor the CERT/CC advisory (https://kb.cert.org/vuls/id/152953) and PayRange's app-store listings and upgrade to any release later than 7.0.7 as soon as the vendor confirms a fix, since this is a client-side app fix that only takes effect once users update. Because exploitation depends on the SSL bypass to inject content, the most effective compensating control for users is to avoid using the app on untrusted or public Wi-Fi and prefer cellular data or a trusted VPN, which denies the man-in-the-middle position needed for injection (trade-off: user-dependent and not enforceable centrally). For the vendor/defenders, remediation should include enforcing strict certificate validation and certificate pinning to eliminate the SSL bypass, and restricting or removing the WebView JavaScript-to-native bridge and disabling JavaScript execution on untrusted content within the WebView (trade-off: may break in-app web features that rely on the bridge).
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today