the-callback-that-outlived-the-page-cve-2026-78997-uc-browser-android-universal-xss

CVE-2026-78997 — UC Browser for Android Universal XSS UXSS PoC material for CVE-2026-78997 — Universal Cross-Site Scripting in UC Browser for Android com.UCMobile.intl, version 13.7.8.1314, disclosed by Omri Inbar Novee. A reflected XSS on the bridge-whitelisted domain mtmsg.uc.cn grants access t...