UC Browser 13.7.8.1314 Universal XSS (UXSS) Root Cause & Exploit Chain Analysis

UC Browser v13.7.8.1314 — Universal Cross-Site Scripting (UXSS) Vulnerability Overview Type: Universal Cross-Site Scripting (UXSS) Severity: Critical Attack Vector: Remote User Interaction: Single tap to dismiss a login dialog overlay Affected Versions: UC Browser 13.7.8.1314 (and other versions sharing the same bridge) Root Cause This vulnerability is caused by three independent flaws working in conjunction: 1. Flaw 1: Reflected XSS on a Whitelisted Domain - The domain is whitelisted; its registration page directly reflects the parameter into the HTML without escaping characters like , , , allowing full HTML/Script injection. - Example URL: - Rendered HTML: - Since matches the whitelist suffix, JavaScript on this page can access all bridge APIs without restriction. 2. Flaw 2: Stores Attacker-Controlled JavaScript Callbacks - The bridge API accepts and string parameters and stores them as-is in a singleton, without escaping. - When the login window is closed (event 1115) or login succeeds (event 1114, states 101/105/113), the stored callbacks are wrapped in a URI and dispatched via message 1401. 3. Flaw 3: Null URL Guard in - Message 1401 is handled by , which executes JavaScript in a specified browser tab. - When (the URL guard) is empty (as is always the case for callbacks), the JavaScript is executed unconditionally on whatever page is currently loaded, regardless of its origin, thereby bypassing the same-origin policy. Exploit Chain 1. The victim clicks a crafted link — the URL points to , with the XSS payload in the parameter. 2. The injected tag executes on — a whitelisted domain with full bridge access. 3. is invoked, with and set to the attacker's JavaScript payload. The native singleton stores the callbacks and the caller's (identifying this tab). 4. navigates the tab to . The tab now displays google.com. The stored callbacks and persist in memory — they are not cleared by navigation. 5. The UC Browser login dialog appears as a native overlay on top of google.com ("Sign in with Google" / "Sign in with UC Account"). 6. The victim interacts with the dialog — clicking any login option, or pressing X or otherwise dismissing the dialog, triggers event 1115 ( state 13). 7. Event 1115 triggers — sending message 1401 with the attacker's JavaScript, an empty URL guard, and the original . 8. resolves the to the tab — now displaying google.com — and calls with the attacker's code. 9. Arbitrary JavaScript executes on google.com's own origin — the attacker can read , , DOM content, or perform any action as the user. POC / Exploit Code Attacker Page (XSS on mtmsg.uc.cn) User Dismisses the Login Dialog Proof of Concept Open the following URL in UC Browser: after the page redirects to google.com, the login dialog appears. Click "Sign in with Google" or "Sign in with UC Account", then press X to dismiss it. Decoded Exploit Code Silent Cookie Exfiltration Variant Replace the callback with: This allows cookies to be exfiltrated silently without visible popups. Impact Cookie Theft: from any origin (banking, email, social media) Session Hijacking: attacker obtains valid session tokens from google.com, facebook.com, etc. Credential Theft: reads stored form data, localStorage tokens DOM Manipulation: modifies content of pages loaded on trusted domains Full Account Takeover: on any site where the user is logged in UC Account Takeover: direct token theft via bridge API Device Tracking: leaks IMSI and SIM carrier via bridge

Goal Reached Thanks to every supporter — we hit 100%!

UC Browser 13.7.8.1314 Universal XSS (UXSS) Root Cause & Exploit Chain Analysis

More from this source