CVE-2026-86550: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in ZTE NebulaOS

ZTE NebulaOS's NuBrowser component suffers from a UXSS vulnerability due to improper input neutralization (CWE-79). Specifically, the S.browser_fallback_url field of intent:// URLs lacks protocol whitelist validation, which allows attackers to inject javascript: URLs through 302 redirects. This flaw enables execution of arbitrary scripts within the context of arbitrary website origins, potentially compromising user security. The vulnerability is publicly disclosed with a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). No vendor-provided patch or mitigation details are currently available.

Successful exploitation allows attackers to execute arbitrary JavaScript code within the origin of arbitrary websites via the NuBrowser component in ZTE NebulaOS. This can lead to unauthorized script execution affecting confidentiality but does not impact integrity or availability according to the CVSS vector. The vulnerability requires user interaction (UI:R) and network attack vector (AV:N).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should exercise caution when handling intent:// URLs and avoid interacting with untrusted redirects that may exploit this vulnerability.