CVE-2026-86898

A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting...

EUVD-2026-77932

A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting...

CVE-2026-86898

A logic issue in state management within Apple's web archive handling allows universal cross-site scripting (XSS) when a user opens a maliciously crafted webarchive file . The vulnerability affects Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27 , and was addressed with improv...

CVE-2017-7089

CVE-2017-7089 影響 : 悪意を持って作成されたWebコンテンツを処理すると、ユニバーサルクロスサイトスクリプティングが発生する可能性があります。 説明 : 親タブの処理にロジックの問題がありました。この問題は、状態管理の改善により対処されました。 Safari 10 ローカルSOPバイパス root@kitploit: function Pewvar doc=open'parent-tab://apple.com';doc.document.body.innerHTML='';Click me! Frans Rosén によるエクスプロイト root@kitploit:...

CVE-2017-5124

CVE-2017-5124 UXSS with MHTML デモ： https://bo0om.ru/chromepoc/PoC.php （テスト済み Chrome/61.0.3163.100）...

CVE-2021-43530-UXSS-On-QRcode-Reader-

CVE-2021-43530-QR码读取器上的UXSS- Firefox for Android中存在一个通用XSS漏洞，原因是处理从QR码扫描的URL时消毒不当。此漏洞仅影响Firefox for Android。其他操作系统不受影响。该漏洞影响Firefox 94。...

the-callback-that-outlived-the-page-cve-2026-78997-uc-browser-android-universal-xss

CVE-2026-78997 — UC Browser for Android 通用 XSS UXSS CVE-2026-78997 的 PoC 材料 — UC Browser for Android（com.UCMobile.intl，版本 13.7.8.1314）中的通用跨站脚本漏洞，由 Omri Inbar Novee 披露。 在桥接白名单域名 mtmsg.uc.cn 上的反射型 XSS 可获取特权 ucapi JavaScript 桥接的访问权限。account.openLoginWindow 桥接 API 将攻击者控制的 JavaScript...

RP_DCP_Code_Exec

Real Player 'DCP://' URI 远程任意代码执行漏洞 视频演示：https://youtu.be/AMODp3iTnqY 'DCP://' URI 方案是 Real Player 使用的一种内部协议，用于获取要在播放器浏览器选项卡中显示的 URL。 它代表"数据缓存协议"（Data Cache Protocol）。它将从 '%appdata%\real\realplayer' 目录获取文件。 这些文件是简单的 '.ini' 文件，包含以下代码： ---sampledcp.ini--- urls onlineurl=http://example.com/...

CVE-2026-78997

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

EUVD-2026-72670

NuBrowser lacks protocol whitelist validation for the S.browserfallbackurl field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting UXSS vulnerability that enables script execution within the origin of arbitrary websites...

CVE-2026-78997

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

EUVD-2026-72957

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

PT-2026-87176

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

CVE-2026-78997

UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314 ) is affected by a Universal Cross-Site Scripting vulnerability. The root cause is a reflected XSS on a UC-owned domain that leverages the browser's internal JavaScript bridge to register a deferred callback. This allows an at...

CVE-2026-17962

Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17739

Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML UXSS via a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: High...

CVE-2026-14083

Insufficient validation of untrusted input in HTML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Low...

CVE-2026-11150

Summary: CVE-2026-11150 is an UXSS (arbitrary script/HTML) in Chrome due to an inappropriate XML implementation. Affected product: Google Chrome (Chromium base); vulnerable component: XML handling in the browser; root cause: improper XML processing leads to script/HTML injection via a crafted HTM...

Google Chrome < 53.0.2785.92 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 53.0.2785.92. It is, therefore, affected by multiple vulnerabilities as referenced in the 201608stable-channel-update-for-desktop31 advisory. - Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.89 on...