CVE-2026-12065: Groww Android App Custom URL Scheme Authorization Bypass

Technical summary

CVE-2026-12065 is a low-severity improper authorization vulnerability in the WebView URL Handler component of Groww's Android application. The flaw resides in the custom URL scheme handler logic, where insufficient authorization checks allow manipulation of the handler behavior. The vulnerability maps to CWE-285 (Improper Authorization) and CWE-939 (Comparison Using Wrong Factors), indicating that the authorization decision either fails to occur or relies on flawed comparison logic. The CVSS 3.1 score of 1.8 reflects the requirement for physical device access, high attack complexity, and limited impact scope—only integrity is affected, with no confidentiality or availability compromise.

Business impact

The direct impact to Groww users is minimal. While the vulnerability could allow a local attacker to perform unauthorized actions through crafted URL scheme invocations (such as navigating to unintended app states or triggering unvalidated internal operations), the barrier to exploitation is high: the attacker requires physical possession of an unlocked or partially authenticated device. For Groww, the primary concern is maintaining user trust in the security of financial and investment features. Remediation is prudent before this receives widespread attention, but does not warrant emergency security operations response given the CVSS 1.8 rating and high attack complexity.

Affected systems

Groww Stock, Mutual Fund, Gold App on Android, versions up to and including 20260805. The vulnerability does not affect iOS, web, or other platforms. Users running the app on affected Android versions should monitor for and install security updates once available. Vendor contact was made early in the disclosure process, suggesting a coordinated fix may already be in development.

Exploitability

Exploitation requires physical access to an Android device, a relatively high degree of technical knowledge to craft malicious URLs targeting the custom scheme handler, and pre-existing user authentication or partial access to the device. A public exploit is available, but the complexity and access requirements make opportunistic attacks unlikely. Attackers would typically need to be physically present during or after a user session, limiting real-world risk to scenarios involving lost or stolen devices, or shared family/work devices. The difficulty rating provided in the original disclosure reinforces that triggering the vulnerability is not trivial.

Remediation

Users should update the Groww app to a patched version once released by the vendor. Groww's development team should review and strengthen the authorization logic in the WebView custom URL scheme handler, ensuring that all handler functions validate the caller's identity and permissions before executing sensitive operations. Input validation on URL parameters should also be hardened. Organizations managing shared Android devices should consider restricting app installation permissions and enforcing device lock policies to reduce physical access risk.

Patch guidance

Monitor Groww's official app store listings (Google Play Store) and security advisories for version updates addressing this issue. Verify patch availability against the vendor's official security announcements once released. Users should enable automatic updates where possible. Since the vulnerability requires physical device access and authentication, patching should be scheduled in your normal update cycle rather than treated as an emergency, but should not be deferred indefinitely. Once an update is available, deploy it within 30–60 days depending on your device management policy.

Detection guidance

Detection in production is challenging without intrusion detection on the device itself, as the attack occurs through app-internal URL scheme handling. Mobile device management (MDM) solutions can verify that affected app versions are no longer in use across your fleet. On a compromised device, forensic analysis would reveal whether the WebView handler was invoked with unexpected or malicious URL parameters, though this requires device-level access. Focus detection efforts on monitoring for app updates and ensuring compliance with patch deployment timelines. If your organization uses Groww for employee financial services, conduct an audit of devices running versions before the patched build.

Why prioritize this

This vulnerability scores CVSS 1.8 (LOW) and requires physical device access plus high attack complexity, placing it in the lowest tier of risk. No ransomware or widespread active exploitation is indicated. Prioritization should be routine: schedule patching within your standard update window (30–90 days), but do not escalate to critical response teams. The early vendor contact noted in the disclosure suggests responsible remediation is underway. Reassess prioritization only if the vulnerability is added to CISA's Known Exploited Vulnerabilities catalog (currently absent) or if evidence of field exploitation emerges.

Risk score, explained

The CVSS 3.1 score of 1.8 reflects multiple limiting factors: (1) Attack Vector: Physical—attacker must be present with the device; (2) Attack Complexity: High—crafting and delivering the exploit requires technical sophistication; (3) Privileges Required: Low—but only partial/temporary access; (4) User Interaction: None—the attack does not require the user to click a link; (5) Scope: Unchanged—impact is confined to the app; (6) Impact: Only Integrity is Low—no loss of confidentiality or availability. The combination of physical access requirement and high complexity makes the practical risk environment-dependent; in organizations with strong mobile device management and physical security, risk is negligible.

Frequently asked questions