Executive brief
UC Browser is a mobile web browser used to browse websites on Android devices. A critical vulnerability allows an attacker to execute malicious code in the browser that can access any website a user visits, steal login credentials, intercept sensitive data, or redirect users to fraudulent sites. The attack requires only a victim to click a link and dismiss a login dialog, making it a serious risk to all users of the affected browser version.
Technical details
A universal cross-site scripting (UXSS) vulnerability (CWE-79) exists in UC Browser for Android version 13.7.8.1314, caused by three chained flaws: (1) a reflected XSS on mtmsg.uc.cn, a whitelisted domain, allows arbitrary script injection; (2) the account.openLoginWindow bridge API stores attacker-controlled JavaScript callbacks in native memory without sanitization; (3) the message 1401 handler (u3()) executes stored JavaScript with an insufficient empty-URL origin guard, allowing cross-origin execution. An attacker crafts a malicious URL on a UC-owned domain that registers a deferred callback via the JavaScript bridge, navigates to a victim site, and executes arbitrary code in that origin when a login dialog is dismissed. The attack requires a single user interaction (dismissing a dialog) and results in complete compromise of the same-origin policy for any visited website. No patch information is publicly available at this time.
Affected products
- UC Browser UC Browser for Android 13.7.8.1314
Timeline
- 2026-09-08: disclosed: CVE-2026-78997 published on NVD