Attack Chain

1. Attacker crafts a malicious URL targeting the reflected XSS parameter on the bridge-whitelisted domain mtmsg.uc.cn.
2. The malicious URL triggers the account.openLoginWindow bridge API within the UC Browser environment.
3. The attacker-supplied JavaScript payload is stored in the application's native memory as a callback.
4. The application navigates to a victim website (e.g., a banking site or webmail) chosen by the attacker.
5. The attacker lures the user into opening the native login dialog provided by the ucapi bridge.
6. The user dismisses the dialog (e.g., presses the 'X' button or taps outside the window).
7. The application dispatches the stored callback, which executes the malicious JavaScript payload.
8. The payload runs in the origin context of the victim website, facilitating data theft or unauthorized actions.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the context of any website visited by the user. This grants an attacker the ability to steal sensitive session cookies, tokens, or personal information, as well as perform actions on behalf of the user, such as modifying account settings or initiating fraudulent transactions. This vulnerability is particularly dangerous for users of mobile banking or sensitive web-based services on affected versions of UC Browser.

Recommendation

1. Update UC Browser for Android to the latest patched version available from the vendor.
2. If an update is not immediately available, restrict the use of the browser for accessing sensitive web services.
3. Monitor device-level logs for signs of suspicious WebView activity if using advanced mobile threat defense tooling.
4. Educate users to avoid clicking suspicious links that may redirect to mtmsg.uc.cn while using the browser.