Executive brief
NuBrowser is a mobile browser that processes specially crafted web links (intent:// URLs) to delegate actions to other applications. A flaw allows attackers to bypass security checks and inject malicious JavaScript code that executes with the privileges of any website the user visits, potentially stealing credentials, session tokens, or sensitive information.
Technical details
The vulnerability is a universal cross-site scripting (UXSS) flaw in NuBrowser's handling of intent:// protocol URLs. The browser fails to properly validate the S.browser_fallback_url parameter, which is intended to specify a safe fallback target if an app is not installed. An attacker can craft a 302 HTTP redirect containing a javascript: URL in this field, bypassing the protocol whitelist. When processed, this allows arbitrary JavaScript execution within the origin of any website, not just the attacker's own site. The vulnerability is remotely exploitable via a crafted web page or malicious redirect and requires no user authentication or special privileges beyond visiting a malicious URL.
Affected products
- ZTE NuBrowser
Timeline
- 2026-09-08: disclosed
- 2026-09-08: advisory