CVE-2026-78997: n/a

CVE-2026-78997 is a Universal Cross-Site Scripting vulnerability in UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314). An attacker can host a specially crafted URL on a UC-owned domain that triggers a reflected XSS. This XSS leverages the browser's internal JavaScript bridge to register a deferred callback, then navigates the browser tab to a victim site. When the victim site displays a login dialog and it is dismissed, the attacker-controlled JavaScript executes in the context of that site, potentially compromising user data or session integrity.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the security context of any origin within the browser, leading to potential theft of sensitive information, session hijacking, or other high-impact actions. The CVSS score of 9.3 reflects critical confidentiality and integrity impacts with no required privileges but requires user interaction.

No patch or official fix information is currently available for this vulnerability. Users should exercise caution when interacting with URLs hosted on UC-owned domains and avoid dismissing unexpected login dialogs. Monitor the vendor's advisory channels for updates and apply any official patches once released.