CVE-2026-12065: Groww App Auth Bypass Vulnerability

CVE-2026-12065 Overview

CVE-2026-12065 is an improper authorization vulnerability [CWE-285] in the Groww Stock, Mutual Fund, Gold App for Android, affecting builds up to version 20260805. The flaw resides in the WebView URL handler, specifically in the handler for a custom URL scheme. An attacker with physical access to an unlocked device can manipulate custom scheme URIs to bypass intended authorization checks, including weak client-side app lock enforcement. The vendor was contacted prior to public disclosure, and a public proof-of-concept is available.

Critical Impact
Physical attackers can leverage unsafe WebView URL handling to bypass client-side app lock enforcement and access protected in-app functionality on the Groww Android application.

Affected Products

Groww Stock, Mutual Fund, Gold App for Android
Versions up to and including build 20260805
Component: WebView URL Handler (custom URL scheme)

Discovery Timeline

2026-06-12 - CVE-2026-12065 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-12065

Vulnerability Analysis

The vulnerability stems from how the Groww Android application processes URLs delivered to its WebView component. The handler accepts custom URL scheme inputs without enforcing proper authorization checks before routing the request to privileged in-app functionality. This is classified under [CWE-285] Improper Authorization.

The weakness is compounded by client-side enforcement of the app lock. Because the lock state is evaluated only on the client and not tied to authorization decisions for individual URL handlers, an attacker who can interact with the device can reach views and actions that should require re-authentication. Attack complexity is high and the exploit requires physical access, which limits practical exploitation but does not eliminate risk for shared, lost, or stolen devices.

Root Cause

The root cause is missing authorization logic within the WebView custom URL scheme handler. The application trusts incoming scheme URIs and dispatches them to internal views without verifying that the current session is authenticated or that the app lock state permits the operation. Authorization is treated as a UI-layer concern rather than a control enforced at the handler boundary.

Attack Vector

An attacker requires physical access to the target device running the vulnerable Groww application. The attacker triggers a crafted custom scheme URI, either through another app, a launcher shortcut, or an adb-driven intent, causing the WebView handler to load a protected view while the app lock should be active. Because no server-side authorization step gates the action, the in-app screen renders without enforcing re-authentication.

A public proof-of-concept is hosted in the researcher's GitHub PoC Repository, with supporting artifacts in a Google Drive Resource Folder. Additional metadata is tracked in VulDB CVE-2026-12065.

No verified exploit code is reproduced here. Refer to the linked PoC repository for technical details.

Detection Methods for CVE-2026-12065

Indicators of Compromise

Invocation of Groww custom URL schemes from external applications or adb shell am start commands targeting the Groww package.
Application launches that immediately render authenticated views without a preceding biometric or PIN prompt.
Unexpected WebView navigation events to internal routes shortly after device unlock by a non-owner.

Detection Strategies

Inspect Android logs (logcat) for Intent filters matching the Groww custom scheme and correlate with app lock state transitions.
Use Mobile Device Management (MDM) telemetry to flag installations of the Groww app at builds at or below 20260805.
Monitor for installation of secondary apps capable of issuing custom scheme intents on managed devices.

Monitoring Recommendations

Track Groww application version inventory across managed Android devices and alert on outdated builds.
Audit physical device access events such as multiple failed unlocks followed by financial app usage.
Review app-launch telemetry from mobile threat defense tools for anomalous deep-link invocations.

How to Mitigate CVE-2026-12065

Immediate Actions Required

Update the Groww Stock, Mutual Fund, Gold App to the latest version available in the Google Play Store, beyond build 20260805.
Enable device-level screen lock with biometric or strong PIN to limit physical access.
Restrict installation of untrusted applications that could chain into Groww's custom URL scheme.

Patch Information

No specific vendor patch advisory is referenced in the available data. Users should monitor the VulDB entry for CVE-2026-12065 and the Google Play Store listing for updated builds released after 20260805. The vendor was notified prior to public disclosure.

Workarounds

Avoid leaving the device unlocked and unattended, particularly in shared environments.
Use Android work profiles or MDM containerization to isolate the Groww application from other installed apps that can issue intents.
Remove the Groww application from devices that cannot be updated until a fixed build is installed.

bash

# Example: verify installed Groww version on a managed Android device
adb shell dumpsys package com.nextbillion.groww | grep versionName

# Example: list intent filters exposed by the Groww package for review
adb shell dumpsys package com.nextbillion.groww | grep -A2 "Scheme:"