Improper input validation in Oppo Health
CVE-2026-22072
Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Affected products
- Oppo Health — versions 6.2.9