CVE-2026-44698: Home Assistant Companion App Token Theft Vulnerability

Technical summary

The vulnerability exploits two configuration weaknesses in the Home Assistant Companion mobile apps. First, the JavaScript bridge methods (window.externalApp on Android and webkit.messageHandlers functions including getExternalAuth, revokeExternalAuth, and externalBus on iOS) are exposed to all frames in the WebView, including cross-origin iframes, without proper origin validation. Second, callback identifiers passed to these bridge methods are not sanitized before interpolation into JavaScript execution contexts. An attacker can embed a malicious cross-origin iframe within a webpage loaded by the Companion app's built-in browser. When this iframe invokes the exposed bridge methods with specially crafted callback parameters, it bypasses same-origin policy enforcement and executes arbitrary JavaScript in the context of the Home Assistant frontend's main frame, gaining access to the authentication token stored in that origin.

Business impact

Compromise of a user's Home Assistant access token enables full account takeover, allowing attackers to query, control, and reconfigure all smart home automations and devices managed by that instance. Depending on Home Assistant deployment scope, this could include lighting, locks, thermostats, security cameras, and other IoT devices in residential or small commercial environments. Attackers could also pivot to cloud-connected services if Home Assistant integrations with external platforms (weather APIs, voice assistants, etc.) are configured. For organizations deploying Home Assistant in multi-user or shared environments, credential theft poses data privacy and facility control risks.

Affected systems

Home Assistant Companion app versions prior to 2026.4.1 on iOS and prior to 2026.4.4 on Android are vulnerable. The attack requires that a user visit an attacker-controlled website (or be redirected to one through compromised advertising or phishing) within the app's built-in browser or WebView component. Users of Home Assistant web interface on standard web browsers are not directly affected unless they access the Home Assistant frontend through a vulnerable Companion app.

Exploitability

The vulnerability requires user interaction—specifically, a victim must visit a malicious webpage while using the Companion app—making the attack vector network-based but contingent on social engineering or compromise of legitimate web content. The attack does not require authentication or special privileges. Once a user clicks a link or loads a page in the app, the malicious iframe operates transparently. The complexity is moderate due to the need to craft a proper iframe payload that triggers the bridge and exfiltrates the token, but automation tooling can lower the barrier for attackers. Public disclosure and technical details will likely enable widespread exploitation once patches are widely deployed.

Remediation

iOS users should upgrade to Home Assistant Companion app version 2026.4.1 or later. Android users should upgrade to version 2026.4.4 or later. Both patches validate the origin of frames invoking the JavaScript bridge and sanitize callback identifiers to prevent code injection. Users should prioritize this update as soon as it is available in their respective app store. If a user suspects their Home Assistant token has been compromised (unusual automations triggering, unexpected device state changes, or suspicious login attempts), they should immediately rotate their authentication credentials in Home Assistant settings and review connected integrations.

Patch guidance

Update the Home Assistant Companion app for iOS to 2026.4.1 or later and for Android to 2026.4.4 or later via the iOS App Store or Google Play Store respectively. Verify the update installation by checking the app version in Settings > About. No configuration changes are required post-update. Organizations that manage Home Assistant instances used by multiple team members should communicate the update requirement and verify deployment across all user devices. Consider enabling Home Assistant's optional authentication logs if available to audit any suspicious token usage during the patching window.

Detection guidance

Monitor Home Assistant access logs and authentication events for anomalous token usage, including login attempts from unexpected IP addresses or user agents during or shortly after the vulnerability window. Check for unusual automation triggers, entity state changes, or service calls that the compromised user did not initiate. Organizations running Home Assistant can implement network segmentation to limit Companion app traffic to trusted endpoints and monitor for unexpected outbound connections that might indicate token exfiltration. If Home Assistant is behind a proxy or reverse proxy, inspect HTTP headers for cross-origin request patterns that might indicate exploitation attempts.

Why prioritize this

This vulnerability warrants prompt remediation because it enables full account compromise with moderate exploitation barriers (social engineering to visit a malicious page) and no requirement for authentication or special privileges. The exposed JavaScript bridge directly handles authentication tokens, making it a high-value target. The CVSS 8.3 score reflects the high confidentiality, integrity, and cross-site impact. Although KEV has not been assigned, the technical simplicity of the underlying flaw and the widespread use of Companion apps in consumer and small-business deployments make exploitation likely following public disclosure.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) is assigned due to: (1) Network attack vector—exploitation occurs over the internet; (2) High user interaction requirement—a user must visit a malicious page; (3) High confidentiality impact—the user's access token is directly exfiltrated; (4) High integrity impact—arbitrary code execution allows modification of Home Assistant state and automations; (5) High availability impact—an attacker can disrupt or disable automations; (6) Changed scope—the vulnerability allows a cross-origin iframe to break out of its sandbox and affect the main Home Assistant frontend context. The overall severity is tempered slightly by the user interaction requirement but remains HIGH due to the severity of credential compromise.

Frequently asked questions