CVE-2026-22072

The EPSS-CVSS gap in CVE-2026-22072 (8.3 CVSS, 0.00253 EPSS) deserves scrutiny beyond the obvious 'hard-to-exploit' reading. A high severity score paired with negligible exploitation probability typically signals one of three conditions: the attack requires unlikely preconditions, the vulnerable pattern has already been hardened through prior disclosure cycles, or the downstream blast radius is so application-specific that aggregate exploitability models cannot capture the real risk. This CVE appears to be all three. The vulnerability involves token theft through a WebView JavaScript bridge when loading external URLs — a pattern that has recurred across Android WebView, iOS WKWebView, Electron, Tauri, and React Native in prior CVE cycles. The low EPSS may partially reflect that repeated prior disclosures have forced vendors toward more secure defaults, narrowing the residual surface. However, surface narrowing is not the same as blast radius containment. In a banking application, token theft cascades to financial fraud within minutes. In a healthcare portal, it cascades to PHI exposure with regulatory consequences compounding for years. In a SaaS client, corporate data exfiltration may unfold over months. The same CVE descriptor produces wildly different risk profiles depending on what the stolen tokens authorize — and EPSS models cannot weight for these downstream privilege escalation paths. The more dangerous possibility is that the low EPSS reflects what the model cannot see: layered exposure. When a WebView vulnerability is patched in the primary application, the same vulnerable pattern often persists in abandoned code — third-party SDKs frozen at old versions, deprecated internal modules still wiring the same JavaScript bridge, test builds never retired. EPSS models the primary disclosure; it has no visibility into the sediment of frozen or hidden code paths where the vulnerable pattern survives untouched. There is also the temporal dimension. EPSS models probability of opportunistic exploitation in the next 30 days. It cannot account for a multi-year pre-discovery window during which targeted actors may have already mapped and exploited this exact failure mode. The 0.00253 does not signal that exploitation is difficult — it signals the model is blind to what already happened. Prior CVE cycles did not vaccinate the ecosystem; they mutated the pattern. Each fix addresses a specific bridge exposure without questioning whether tokens should ever be reachable from contexts loading untrusted content. The institutional memory of why each bypass worked does not survive staff turnover or framework migrations. The same flawed WebView embedding pattern reappears in each vertical because it was never fully documented as an anti-pattern — it gets patched, but it does not get taught. Expect a sibling component to exhibit identical exposure within 18 months using a different bypass. Defensive priorities: audit for WebView implementations that load external URLs alongside JavaScript bridge access — this combination is the vulnerable pattern regardless of the specific component. Treat any token-scoped API used alongside external URL loading as a high-risk configuration until proven otherwise. Review dependency trees and SDK integrations for frozen WebView implementations that may have bypassed the current patch cycle. Map which systems share blast radius with vulnerable deployments — the question is not just how many are vulnerable, but how many systems cascade from those that are.

Reviewed through automated stages and approved by a human before publication.