CVE-2026-66832: Quanovate Tech Inc. Operating As Mira / Mira Care Mira Android App

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.

Affected products

Published 2026-08-11. Last modified 2026-09-01.