CVE-2024-9285 Overview
CVE-2024-9285 is a cross-site scripting vulnerability [CWE-79] in Tu Yafeng Via Browser versions up to 5.9.0 on Android. The flaw resides in the JavaScript Bridge component, which exposes native browser functionality to loaded web content. Attackers can exploit this weakness remotely by tricking a user into visiting a crafted page. The issue has been publicly disclosed, and a patched build addresses the underlying handling of bridge messages.
Critical Impact
Successful exploitation enables universal cross-site scripting (uXSS) within the Via Browser context, allowing script execution across web origins loaded in the affected mobile browser.
Affected Products
- Tu Yafeng Via Browser versions up to and including 5.9.0
- Android platform installations of Via Browser
- The vulnerable Javascript Bridge component in the browser
Discovery Timeline
- 2025-02-27 - CVE-2024-9285 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-9285
Vulnerability Analysis
The vulnerability affects the JavaScript Bridge component of Via Browser, which links native Android functionality with content rendered inside the browser WebView. When the bridge fails to enforce origin restrictions or sanitize inputs, attacker-controlled web content can invoke bridge methods to inject script into unrelated origins. The result is a universal cross-site scripting condition, where script executes with the privileges of any site the browser has loaded. The Modzero advisory MZ-25-01 documents the affected bridge interfaces and demonstrates the impact on user data confidentiality within the browser.
Root Cause
The root cause is improper neutralization of input passed through the JavaScript Bridge interface between the WebView and native code. The bridge accepts content from any loaded page without sufficient origin isolation or output encoding. This design permits an untrusted origin to reach code paths that render or inject markup into other origins.
Attack Vector
An attacker hosts a crafted HTML page and lures a Via Browser user to visit it. User interaction is required to trigger the exploit chain, such as clicking a link or opening a bookmark. Once loaded, the page issues calls into the exposed bridge methods, causing script execution in the context of other origins loaded by the browser. See the Modzero Security Advisory MZ-25-01 and the Modzero PDF Report for the demonstrated attack sequence.
No verified proof-of-concept code is republished here. Refer to the vendor and researcher advisories for technical exploitation detail.
Detection Methods for CVE-2024-9285
Indicators of Compromise
- Outbound requests from mobile devices to unfamiliar domains hosting HTML content that invokes non-standard JavaScript bridge methods.
- Presence of Via Browser installations at or below version 5.9.0 on managed Android endpoints.
- Unexpected data exfiltration patterns originating from browser sessions on Android devices.
Detection Strategies
- Inventory Android endpoints and enumerate installed Via Browser versions using mobile device management telemetry.
- Inspect proxy or DNS logs for browsing sessions that load content referencing bridge interface names published in the Modzero advisory.
- Correlate browser process behavior with anomalous network egress to identify script execution outside expected origins.
Monitoring Recommendations
- Enable web content filtering to block delivery of exploit pages targeting mobile browser bridges.
- Alert on installations of Via Browser versions at or below 5.9.0 across the managed Android fleet.
- Review browser telemetry for repeated cross-origin script activity that may indicate uXSS chaining.
How to Mitigate CVE-2024-9285
Immediate Actions Required
- Upgrade Via Browser to a version above 5.9.0 that addresses the JavaScript Bridge weakness.
- Restrict or remove Via Browser from managed Android devices where an updated build is not available.
- Educate users to avoid opening untrusted links inside Via Browser until the update is applied.
Patch Information
The vendor has released a patched version of Via Browser that addresses the JavaScript Bridge input handling. Consult the Modzero Security Advisory MZ-25-01 and the VulDB entry #297863 for version-specific patch confirmation. Apply the update through the Android application distribution channel used in your environment.
Workarounds
- Disable Via Browser on affected devices and route users to an alternative Android browser until patching completes.
- Enforce mobile web filtering policies that block untrusted domains from loading on managed devices.
- Restrict application installation permissions to limit exposure to unpatched browser builds.
No vendor-published configuration snippet is available. Apply the updated application package through your standard Android deployment tooling.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
