CVE-2026-78997 Overview
CVE-2026-78997 is a Universal Cross-Site Scripting (UXSS) vulnerability in UC Browser for Android (com.UCMobile.intl, version 13.7.8.1314). The flaw allows attackers to execute arbitrary JavaScript in the context of any origin loaded by the browser. Exploitation abuses a reflected XSS on a UC-owned domain, which then leverages the browser's internal JavaScript bridge to register a deferred callback. When the tab navigates to a victim site and a login dialog is dismissed, the attacker's code executes under that victim origin, bypassing the same-origin policy.
Critical Impact
An attacker who convinces a user to visit a crafted URL can execute JavaScript against arbitrary origins, enabling session theft, credential harvesting, and account takeover across every site the user visits in UC Browser.
Affected Products
- UC Browser for Android (com.UCMobile.intl)
- Version 13.7.8.1314
- Android platform installations
Discovery Timeline
- 2026-09-08 - CVE-2026-78997 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-78997
Vulnerability Analysis
The vulnerability is a Universal Cross-Site Scripting flaw classified under [CWE-79]. UXSS differs from traditional XSS because the injected script is not confined to a single vulnerable origin. Instead, it runs within any origin the browser renders, defeating the same-origin policy that isolates web applications from one another.
Exploitation chains three primitives. First, a reflected XSS on a UC-owned domain gives the attacker initial JavaScript execution inside a trusted first-party context. Second, that JavaScript accesses the browser's internal JavaScript-to-native bridge to register a callback that will fire later. Third, the tab is navigated to a targeted victim site, and dismissing an in-browser login dialog triggers the deferred callback, which executes attacker-controlled JavaScript in the victim origin.
The attack requires user interaction, since the victim must open the crafted link and dismiss the login prompt. Successful exploitation yields full read and write access to the victim site's DOM, cookies accessible to script, and any authenticated session data.
Root Cause
The root cause is unsafe handling of the internal JavaScript bridge combined with a reflected XSS sink on a UC-controlled domain. The bridge does not re-validate the calling origin when the deferred callback fires. Once the tab has navigated to a new origin, the callback still executes with script privileges scoped to the new page.
Attack Vector
Delivery is network-based and requires a single user click on an attacker-crafted URL. The URL points at a UC-owned domain that reflects attacker-supplied JavaScript. That script uses the exposed JavaScript bridge to schedule its payload, then triggers navigation to the intended victim site. When the user dismisses the login dialog rendered by UC Browser, the payload runs with the victim origin's privileges.
No verified proof-of-concept code is republished here. Technical details are available in the GitHub Gist Security PoC and the GitHub Gist Analysis Document.
Detection Methods for CVE-2026-78997
Indicators of Compromise
- Outbound HTTP requests from Android devices to UC-owned domains carrying reflected query parameters containing <script>, javascript:, or JavaScript-bridge method names.
- Installed package com.UCMobile.intl at version 13.7.8.1314 on managed Android endpoints.
- Unexpected cross-origin requests, cookie exfiltration, or DOM modifications originating from UC Browser sessions.
Detection Strategies
- Inspect mobile web proxy and network logs for URLs targeting UC-owned domains that include encoded script payloads or bridge method identifiers as parameters.
- Use mobile device management (MDM) inventories to enumerate devices running the vulnerable UC Browser package and version.
- Correlate browser navigation events with subsequent anomalous authentication attempts against enterprise SaaS applications.
Monitoring Recommendations
- Alert on installations of com.UCMobile.intl version 13.7.8.1314 across mobile fleets.
- Monitor identity provider logs for anomalous session activity following user visits to UC-owned domains.
- Track outbound DNS and HTTP telemetry from Android devices for known UC infrastructure paired with suspicious URL parameters.
How to Mitigate CVE-2026-78997
Immediate Actions Required
- Uninstall or disable UC Browser (com.UCMobile.intl) version 13.7.8.1314 on all managed Android devices.
- Direct users to an alternative browser with active security maintenance until a patched UC Browser release is confirmed.
- Force-reauthenticate high-value SaaS sessions for users who recently used UC Browser to invalidate any stolen session tokens.
Patch Information
No vendor advisory or patched version is listed in the NVD entry at the time of publication. Administrators should track vendor communications from UCWeb and apply an updated UC Browser build as soon as one is released. Refer to the GitHub Gist Analysis Document for additional technical background.
Workarounds
- Block installation of com.UCMobile.intl through MDM application allow-lists or blocklists.
- Restrict access to UC-owned domains at the corporate network egress or mobile secure web gateway.
- Educate users to avoid clicking untrusted links inside UC Browser and to prefer a maintained mainstream browser for authenticated work applications.
# Example MDM policy fragment: block the vulnerable package on Android
# Applied via enterprise MDM (Intune, Workspace ONE, Jamf, etc.)
blocked_packages:
- com.UCMobile.intl
enforcement: uninstall_if_present
notify_user: true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
