CVE-2020-7364: UCWeb UC Browser Address Bar Spooofing
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of UCWeb UC Browser 13.0.8 and earlier are affected. Exploitation targets the browser user through its address bar display rather than requiring access to the device or browser account.
What does an attacker need to exploit it?
The attacker can exploit the issue remotely with low attack complexity and no privileges, but user interaction is required. The vulnerability enables the attacker to obscure the true source of data shown in the browser.
What is the likely security impact?
The stated CVSS vector indicates integrity impact without confidentiality or availability impact. In practice, the risk is that misleading address-bar information could cause a user to trust content from an attacker-controlled source.