Token theft via untrusted WebView URLs

Input validation in WebView handling in OPPO Health 6.2.9 allows remote attackers to steal user tokens via attacker-controlled URLs. The published records indicate that a WebView component accepts and renders arbitrary external pages; from that description, the likely failure is missing origin or URL restrictions that let attacker-supplied script execute inside the app's embedded browser context and reach tokens exposed to that view. Exploitation requires getting a user to open crafted external content in the app, and the public record does not describe code execution outside the WebView or broader availability impact.