Auth bypass in Groww Stock, Mutual Fund, Gold App
CVE-2026-12065
A vulnerability was identified in Groww Stock, Mutual Fund, Gold App up to 20260805 on Android. This affects an unknown part of the component WebView URL Handler. The manipulation leads to improper authorization in handler for custom url scheme. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 1.8 (Low). Vector: CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.001 (1.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 1st percentile — 1.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: 0.000
Affected products
- Groww Stock, Mutual Fund, Gold App — versions 20260805
Weakness classification (CWE)
References
- drive.google.com/drive/folders/1r9t4AuG747PmRbgLmY2CztsX5PTjQL19 (exploit)
- github.com/honestcorrupt/Groww-Android-Application-Unsafe-WebView-URL-Handling-… (related)
- vuldb.com/cve/CVE-2026-12065 (third-party-advisory)
- vuldb.com/submit/822984 (third-party-advisory)
- vuldb.com/vuln/370560 (vdb-entry)
- vuldb.com/vuln/370560/cti (signature, permissions-required)
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
Frequently asked questions
- What is CVE-2026-12065?
- CVE-2026-12065 is a low-severity vulnerability in Groww Stock, Mutual Fund, Gold App, classified under Improper Authorization. CVSS score: 1.8/10. Published 2026-06-12.
- How severe is CVE-2026-12065?
- Low severity. CVSS v3 base score is 1.8 out of 10.