External risk intelligence

UC Browser for Android Universal XSS via JavaScript Bridge

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-78997

The vulnerability exists within a specific mobile application (UC Browser for Android) and requires user interaction to visit a specially crafted URL, making it a client-side issue rather than a public-facing network service, edge gateway, or server-side infrastructure reachable by scanning.

Cross-site Scripting

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in UC Browser for Android that could allow an attacker to execute malicious JavaScript within the context of other websites. This occurs when a user visits a specially crafted link, enabling the attacker to potentially compromise user sessions or data on those sites. The main concern is to confirm if this specific application is in use and if so, to understand the potential exposure.

Cross-site scripting vulnerability in UC Browser.
Impacts user context on other websites visited.
Confirm relevance and user exposure within the organization.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking a user into visiting a malicious URL hosted on a UC-owned domain. This URL would leverage UC Browser's internal JavaScript bridge to register a deferred callback. The attacker could then navigate the tab to a victim site and execute arbitrary JavaScript in the context of that site once a login dialog is dismissed.

Attacker hosts malicious URL on UC domain.
User visits URL, triggering JavaScript bridge.
Arbitrary JavaScript executed on victim site.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, UC Browser for Android could allow an attacker to execute arbitrary JavaScript in the context of any origin. This could happen when a user visits a specially crafted URL on a UC-owned domain, leading to attacker-controlled code execution on a victim site after a login dialog is dismissed.

Arbitrary JavaScript execution in browser context.
Specially crafted URL on UC-owned domain.
Potential for attacker-controlled website code.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in UC Browser for Android requires a user to interact with a malicious URL. The first step is for the application owner to identify affected users and devices, assess the risk based on usage, and then plan remediation, which may involve user guidance or app updates.

Application owners must own the issue.
Verify affected user devices and exposure.
Guide users to update the application.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is UC Browser for Android?

UC Browser is a mobile web browser developed by UCWeb, a subsidiary of Alibaba. Version 13.7.8.1314 is the specific release identified with this vulnerability. It is used globally for mobile web navigation, providing features like a built-in JavaScript bridge that facilitates communication between the web content and the browser's underlying mobile application functions.

How does CVE-2026-78997 work?

This vulnerability is classified as Universal Cross-Site Scripting (CWE-79). Unlike traditional XSS that targets a single site, this flaw allows an attacker to run malicious JavaScript on any website the user visits. It works by abusing the browser's internal JavaScript bridge, which is intended for app-to-web communication, to hijack the security context of subsequent pages.

Do I need to be logged into a site for this to trigger?

No, you do not need to be actively logged into a specific site for the trigger mechanism to begin. The attack requires visiting a malicious URL on a UC-owned domain, which registers a deferred callback. The malicious code execution is triggered specifically when the browser dismisses a login dialog, meaning the bug relies on this UI event rather than your existing session state.

Is this vulnerability a risk to my servers?

According to Halo Surface Signal, this is a client-side issue, not a server-side one. It does not affect public-facing network services or infrastructure, so it cannot be reached by network scanners. The risk is localized to the specific mobile devices running the affected browser version, where a user must manually click a link to initiate the threat.

What steps should I take if I use UC Browser?

First, verify if your mobile devices have version 13.7.8.1314 installed. If they do, limit use of this browser for sensitive activities until an update is applied. Ensure you are aware of the browser version in use across your environment and provide clear guidance to users regarding the potential risks of interacting with untrusted or suspicious links while using this specific application.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.