This vulnerability in OPPO Health 6.2.9 involves improper input validation in WebView components, enabling attackers to load arbitrary external URLs. This can lead to execution of malicious JavaScript code within the app context, potentially allowing theft of arbitrary user tokens. The CVSS 4.0 score is 8.3 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality. The vendor has published the vulnerability but has not provided a remediation level or patch information.

Successful exploitation can result in unauthorized access to user tokens due to malicious JavaScript execution in the WebView context. This compromises user confidentiality and could lead to further unauthorized actions within the app or associated services. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should exercise caution when interacting with untrusted URLs within the OPPO Health app. Avoid loading external content through WebView components if possible.