Which versions of OPPO Health are affected by EUVD-2026-60058?

OPPO Health 6.2.9 contains a high-severity vulnerability that enables attackers to steal user authentication tokens through maliciously crafted URLs delivered via the application's WebView component.

How to fix or mitigate EUVD-2026-60058?

Within 24 hours: Conduct a complete inventory of OPPO Health 6.2.9 across your managed device fleet and identify users with access to critical systems or sensitive health infrastructure. Within 7 days: Deploy targeted user awareness training on URL verification and phishing tactics; implement network-level domain filtering where feasible; consult your MDM vendor for application-level controls such as WebView restrictions or sandboxing capabilities. Within 30 days: Establish ongoing monitoring of OPPO security advisories for patch releases; develop and communicate a mandatory upgrade or application replacement roadmap with targeted completion dates based on user criticality.

OPPO Health EUVD-2026-60058

Q: What is the CVSS score of EUVD-2026-60058?

EUVD-2026-60058 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-22072 HIGH

Improper Input Validation (CWE-20)

2026-08-17 OPPO

GHSA-96vw-w9m3-gj89

RCE Oppo Health Oppo

8.3

CVSS 4.0 · Vendor: OPPO

Severity by source

Vendor (OPPO) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Network delivery requires active user interaction (UI:R); scope changes (S:C) because stolen tokens compromise backend systems beyond the vulnerable app; no integrity or availability impact confirmed.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (OPPO).

CVSS VectorVendor: OPPO

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 12:38 vuln.today

CVE Published

Aug 17, 2026 - 06:13 cve.org

HIGH 8.3

DescriptionCVE.org

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.

AnalysisAI

WebView URL injection in OPPO Health 6.2.9 enables token theft when a victim interacts with a maliciously crafted URL that loads inside the application's embedded WebView component. The CVSS 4.0 score of 8.3 reflects network-based delivery with low attack complexity, no required privileges, but mandatory active user interaction, with high confidentiality impact on both the vulnerable and subsequent systems. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Technical ContextAI

The root cause is CWE-20 (Improper Input Validation): OPPO Health fails to restrict which external URLs its WebView component is permitted to load. WebView embeds a browser engine inside a native mobile application, and when arbitrary attacker-controlled URLs are rendered, injected JavaScript runs in a context that may have access to native application bridges, session tokens, or stored credentials. The CPE string cpe:2.3:a:oppo:oppo_health:*:*:*:*:*:*:*:* uses a wildcard version range, though EUVD confirms OPPO Health 6.2.9 as the explicitly affected release. The SC:H signal in the CVSS 4.0 vector indicates that stolen tokens affect systems beyond the app itself - for example, backend health services authenticated with those credentials.

RemediationAI

Consult the OPPO security advisory at https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2088198578949595136 for patch details; no exact fixed version number is derivable from the provided intelligence data, so the advisory must be verified directly. As a compensating control pending a patch, users should be advised not to open unverified URLs within the OPPO Health application. Mobile device management (MDM) policies that restrict OPPO Health's outbound network connectivity to a known allowlist of OPPO-operated domains would reduce the attack surface by preventing the WebView from reaching attacker-controlled servers, though this may break legitimate in-app features that rely on loading external content. Disabling deep-link handling for the OPPO Health app at the OS level, if configurable, would also limit the delivery vector.