CVE-2026-86550 Overview
CVE-2026-86550 is a universal cross-site scripting (UXSS) vulnerability in NuBrowser. The browser fails to validate protocol schemes in the S.browser_fallback_url field of intent:// URIs. Attackers can inject javascript: URLs through HTTP 302 redirects, causing script execution within the origin of arbitrary websites. The flaw is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Successful exploitation enables script execution in the context of any website loaded by the victim, allowing session hijacking, credential theft, and same-origin policy bypass across arbitrary domains.
Affected Products
- NuBrowser (Android application)
Discovery Timeline
- 2026-09-08 - CVE-2026-86550 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86550
Vulnerability Analysis
NuBrowser processes Android intent:// URIs, which can contain a S.browser_fallback_url parameter. This parameter specifies a URL to load when the intended application is not available. NuBrowser does not enforce a protocol whitelist on this field, permitting dangerous schemes such as javascript:.
When the fallback URL is fetched, an attacker-controlled server returns an HTTP 302 redirect pointing to a javascript: URL. NuBrowser follows the redirect and executes the JavaScript in the context of the previously loaded page. This produces a universal cross-site scripting (UXSS) condition that breaks the same-origin policy across any origin the victim visits.
User interaction is required, as the victim must open a crafted link. However, once triggered, the attacker executes arbitrary script in the origin of the target site, enabling cookie theft, DOM manipulation, and account takeover.
Root Cause
The root cause is missing input validation on the S.browser_fallback_url scheme. NuBrowser accepts any URL scheme returned from a redirect chain without filtering javascript:, data:, or other dangerous protocols. A protocol allowlist restricted to http, https, and safe schemes would prevent the injection.
Attack Vector
An attacker hosts a malicious page containing an intent:// link. The S.browser_fallback_url parameter points to an attacker-controlled endpoint. That endpoint responds with a 302 redirect whose Location header contains a javascript: payload. When the victim taps the link in NuBrowser, the browser follows the redirect and evaluates the script in the origin of the currently active tab or the target site. Refer to the ZTE Security Bulletin for vendor-supplied details.
Detection Methods for CVE-2026-86550
Indicators of Compromise
- Outbound HTTP requests containing intent:// URIs with S.browser_fallback_url parameters pointing to untrusted domains
- HTTP 302 responses whose Location header begins with javascript: or other non-HTTP schemes
- Anomalous JavaScript execution or DOM modification on legitimate websites accessed through NuBrowser
Detection Strategies
- Inspect mobile web proxy logs for intent:// URIs originating from untrusted referrers and capture the fallback URL parameter for review
- Alert on redirect chains where the terminating Location header contains a non-http(s) scheme
- Correlate NuBrowser user-agent traffic with sessions that trigger unexpected authentication or credential submission events
Monitoring Recommendations
- Monitor mobile endpoints for installations of NuBrowser and inventory affected devices
- Log and retain HTTP redirect chains at network egress to enable retrospective UXSS hunting
- Track user reports of unexpected pop-ups, redirects, or session anomalies on Android devices
How to Mitigate CVE-2026-86550
Immediate Actions Required
- Uninstall or disable NuBrowser on managed Android devices until a vendor-supplied patch is confirmed installed
- Steer users to alternative browsers that enforce scheme validation on Android intent fallback URLs
- Block known malicious domains delivering intent:// payloads at the network and DNS layer
Patch Information
Consult the ZTE Security Bulletin for the current advisory and any released fixed versions. Apply vendor updates as soon as they become available and validate that S.browser_fallback_url is restricted to http and https schemes.
Workarounds
- Configure mobile device management (MDM) policies to restrict installation of vulnerable browser versions
- Educate users to avoid tapping unfamiliar links, especially those containing intent:// schemes
- Deploy web filtering to strip or reject responses whose redirect Location header uses javascript: or data: schemes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.