CVE-2026-22072

Description

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.

References

• https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2088198578949595136