Home Assistant vulnerabilities

Products

• Companion app (Android) 1
• Companion app (iOS) 1

Latest Home Assistant CVEs

Newest publication first

1. CVE-2026-44698 Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection

   Published 2026-05-29

   High·CVSS 8.3 EPSS 0.14%

   Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Home Assistant Companion apps for Android and iOS expose a JavaScript bridge to the in-app WebView window.externalApp on Androi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.