CVE-2026-78997: XSS
UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain (via a reflected XSS) that leverages the browser's internal JavaScript bridge to register a deferred callback, navigate the tab to a victim site, and then execute attacker-controlled code on that site when a login dialog is dismissed.
Affected Software
Event History
Frequently Asked Questions
Which installation is explicitly identified as affected?
The reported affected package is com.UCMobile.intl, UC Browser for Android version 13.7.8.1314. The provided data does not establish the status of other versions or package variants.
What does an attacker need to trigger the exploit chain?
The attacker needs to host a specially crafted URL on a UC-owned domain through a reflected XSS condition. The exploit then uses the browser's internal JavaScript bridge to defer code execution until after navigation to the target site.
Is user interaction involved after the victim site loads?
Yes. The attacker-controlled code executes on the victim site when a login dialog is dismissed.