Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Home As…

Home Assistant Companion apps for Android and iOS expose a JavaScript bridge vulnerability that allows cross-origin iframe exploitation. The vulnerability enables arbitrary JavaScript execution in the main-frame origin and access token exfiltration. Two flaws expose the bridge to all frames including cross-origin iframes and unsanitized interpolation of JavaScript callback identifiers. The issue affects versions prior to 2026.4.1 for iOS and 2026.4.4 for Android. Patches are available in the specified versions.