CVE-2020-7363: UCWeb UC Browser Address Bar Spooofing
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of UCWeb UC Browser for Android version 13.0.8 or earlier are affected. Exploitation requires the user to interact with attacker-controlled content.
What does an attacker need to exploit the vulnerability?
The attacker can exploit it remotely over the network with low attack complexity and no privileges. However, user interaction is required.
What is the practical impact?
An attacker can manipulate the browser address bar presentation to obscure the true source of displayed data. The provided CVSS vector indicates integrity impact but no direct confidentiality or availability impact.