CVE-2026-78997 in UC Browser
Summary
by MITRE • 09/08/2026
UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain (via a reflected XSS) that leverages the browser's internal JavaScript bridge to register a deferred callback, navigate the tab to a victim site, and then execute attacker-controlled code on that site when a login dialog is dismissed.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in UC Browser for Android represents a sophisticated Universal Cross-Site Scripting (UXSS) flaw rooted in improper validation of JavaScript bridge interfaces within the mobile browser's architecture. Unlike traditional cross-site scripting attacks that are constrained by the same-origin policy, this defect allows an attacker to bypass these security boundaries entirely. The core technical issue lies in how the browser handles communication between web content and native application components via its internal JavaScript API. Specifically, the vulnerability exploits a mechanism where external URLs can trigger privileged functions within the browser's engine without sufficient sanitization or origin verification of the calling context. This architectural weakness enables code execution that transcends domain restrictions, effectively granting malicious scripts access to sensitive data and functionality across all visited websites.
The exploitation chain begins with an attacker hosting a specially crafted URL on a UC-owned domain, leveraging a reflected cross-site scripting vector as the initial entry point. Once triggered, this payload does not merely execute within its own context but instead interacts directly with the browser's internal JavaScript bridge to register a deferred callback function. This registration process is critical because it sets up an event listener that remains dormant until specific user interactions occur. The attacker then utilizes navigation techniques to redirect the current tab to a target victim site, such as a banking or email service. At this stage, the malicious script is effectively invisible within the legitimate page's DOM but retains its privileged execution capabilities due to the earlier bridge interaction.
The final phase of the attack occurs when the user interacts with the targeted website, specifically by dismissing a login dialog or modal window. This action triggers the previously registered deferred callback, causing the attacker-controlled JavaScript code to execute in the context of the victim site rather than the original malicious domain. Because this execution happens within the trusted origin's scope, standard browser security models fail to detect it as an attack vector. Consequently, the script can access cookies, session tokens, local storage data, and other sensitive information associated with the victim account. This capability allows for comprehensive account takeover scenarios where the attacker gains persistent or immediate unauthorized access without needing credentials through brute force or phishing alone.
From a classification perspective, this vulnerability aligns closely with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and more specifically falls under the category of Universal XSS which is often associated with CWE-829 Inclusion of Functionality from Untrusted Control. The attack technique mirrors ATT&CK T1059 Command and Scripting Interpreter where JavaScript is used to execute arbitrary commands, and it also relates to T1078 Valid Accounts as the ultimate goal is leveraging valid user sessions for malicious purposes. The use of deferred callbacks and bridge manipulation highlights a failure in enforcing strict origin checks during asynchronous operations involving native interfaces.
Mitigation strategies must focus on hardening the JavaScript bridge implementation within the browser engine. Developers should implement rigorous input validation and output encoding not just at the web page level but also when processing messages received from external sources via internal APIs. It is essential to enforce same-origin policies strictly for all privileged function calls, ensuring that only scripts originating from trusted domains can invoke sensitive methods. Additionally, implementing Content Security Policy directives that restrict script execution contexts could provide an additional layer of defense against such exploitation attempts. For users, keeping the browser updated to versions where this flaw has been patched is critical, as vendor releases typically include fixes for these deep-seated architectural issues. Regular security audits focusing on mobile webview implementations and bridge communication protocols are recommended to identify similar weaknesses before they can be weaponized by threat actors seeking to compromise user data integrity and confidentiality.