Universal XSS in UC Browser for Android via ucapi Bridge

CVE-2026-78997 is a high-severity Universal Cross-Site Scripting (UXSS) vulnerability discovered in UC Browser for Android (version 13.7.8.1314 and likely earlier). The flaw exists within the application's privileged ucapi JavaScript bridge, specifically related to how the account.openLoginWindow API handles login callbacks. Attackers can leverage a reflected XSS vulnerability on the whitelisted domain mtmsg.uc.cn to register malicious JavaScript as a callback in native memory. Due to an implementation error where the callback is stored with an empty URL guard, it persists across page navigations. When a user interacts with the native login dialog and subsequently dismisses it, the browser executes the stored callback via WebView.evaluateJavascript() within the origin of the currently loaded page. This mechanism effectively allows an attacker to execute arbitrary code within the context of any destination website, bypassing the browser's Same-Origin Policy.

Attack Chain

1. Attacker crafts a malicious URL targeting the reflected XSS parameter on the bridge-whitelisted domain mtmsg.uc.cn.
2. The malicious URL triggers the account.openLoginWindow bridge API within the UC Browser environment.
3. The attacker-supplied JavaScript payload is stored in the application's native memory as a callback.
4. The application navigates to a victim website (e.g., a banking site or webmail) chosen by the attacker.
5. The attacker lures the user into opening the native login dialog provided by the ucapi bridge.
6. The user dismisses the dialog (e.g., presses the 'X' button or taps outside the window).
7. The application dispatches the stored callback, which executes the malicious JavaScript payload.
8. The payload runs in the origin context of the victim website, facilitating data theft or unauthorized actions.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the context of any website visited by the user. This grants an attacker the ability to steal sensitive session cookies, tokens, or personal information, as well as perform actions on behalf of the user, such as modifying account settings or initiating fraudulent transactions. This vulnerability is particularly dangerous for users of mobile banking or sensitive web-based services on affected versions of UC Browser.

Recommendation

1. Update UC Browser for Android to the latest patched version available from the vendor.
2. If an update is not immediately available, restrict the use of the browser for accessing sensitive web services.
3. Monitor device-level logs for signs of suspicious WebView activity if using advanced mobile threat defense tooling.
4. Educate users to avoid clicking suspicious links that may redirect to mtmsg.uc.cn while using the browser.