This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the GeniexWebView component of the Transsion AI Assistant Lifestyle app on Android. Specifically, the web_action_data URL parameter is not properly sanitized, enabling remote attackers to inject and execute arbitrary JavaScript code within the WebView context. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low confidentiality and integrity impacts.

Successful exploitation allows remote attackers to execute arbitrary JavaScript code in the context of the vulnerable WebView, potentially leading to partial disclosure of sensitive information and modification of data within the application context. There is no impact on system availability. The vulnerability affects confidentiality and integrity at a low level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published by TECNO Mobile as of the provided data. Users and administrators should monitor for vendor updates and apply patches once available. Until then, caution should be exercised when handling untrusted input to the web_action_data parameter.