CVE-2017-20041: Ucweb UC Browser HTML URL improper restriction of rendered ui layers
A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title leads to improper restriction of rendered ui layers (URL). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
Which installations should be treated as affected?
The affected product is UCWeb UC Browser for Android, specifically version 11.2.5.932. The provided data does not identify other affected or fixed versions.
What does an attacker need to exploit this issue?
The attack can be launched remotely without privileges, but it requires user interaction. The issue involves manipulation of a title argument in the HTML Handler and rendered URL UI layers.
Is public exploitation material available?
Yes. The exploit has been publicly disclosed and may be used.
What is the expected security impact?
The CVSS vector indicates high integrity impact, with no confidentiality or availability impact identified.