CVE-2026-12065

A vulnerability was identified in Groww Stock, Mutual Fund, Gold App up to 20260805 on Android. This affects an unknown part of the component WebView URL Handler. The manipulation leads to improper authorization in handler for custom url scheme. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

• CWE-285
• CWE-939

• https://drive.google.com/drive/folders/1r9t4AuG747PmRbgLmY2CztsX5PTjQL19
• https://github.com/honestcorrupt/Groww-Android-Application-Unsafe-WebView-URL-Handling-Weak-Client-Side-App-Lock-Enforcement.git
• https://vuldb.com/cve/CVE-2026-12065
• https://vuldb.com/submit/822984
• https://vuldb.com/vuln/370560
• https://vuldb.com/vuln/370560/cti
• https://github.com/honestcorrupt/CVE-req-Groww-Android-Application-Unsafe-WebView-URL-Handling-Weak-Client-Side-App-Lock-Enforcement

Published

Jun 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12057When the application executes the JavaScript script embedded…7.8
• CVE-2026-12058The connection confirmation pop-up of a specific feature in …5.3
• CVE-2026-12059The SSH service of CelloOS developed by Cellopoint has an Im…8.8
• CVE-2026-1206The Elementor Website Builder plugin for WordPress is vulner…4.3
• CVE-2026-12060Heptabase developed by Hepta Platforms has a Exposed Dangero…6.9
• CVE-2026-12064When a user invokes curl using a schemeless URL combined wit…7.5
• CVE-2026-12066A security flaw has been discovered in PbootCMS up to 3.2.12…7.3
• CVE-2026-12068Information disclosure vulnerability in Avira Password Manag…7.4
• CVE-2026-1207An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.…5.4
• CVE-2026-12070Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a…8.4
• CVE-2026-12071The Webbox of TeamDavid by Tobit Laboratories AG constructs …5.3
• CVE-2026-12073The ProfileGrid – User Profiles, Groups and Communities plug…9.8