hunt-benito/the-callback-that-outlived-the-page-cve-2026-78997-uc-browser-android-universal-xssPoC for CVE-2026-78997, a Universal XSS in UC Browser for Android. Includes a crafted URL builder, a callback-dispatch oracle, and Frida hooks to observe the vulnerable bridge.
PoC material for CVE-2026-78997 — Universal Cross-Site Scripting in
UC Browser for Android (com.UCMobile.intl, version 13.7.8.1314),
disclosed by Omri Inbar (Novee).
A reflected XSS on the bridge-whitelisted domain mtmsg.uc.cn grants
access to the privileged ucapi JavaScript bridge. The
account.openLoginWindow bridge API stores attacker-controlled
JavaScript strings as login/dismiss callbacks in native memory, where
they survive page navigation. When the user dismisses the native login
dialog over the destination site, the callback is dispatched with an
empty URL guard, and the browser executes it with
WebView.evaluateJavascript() in the origin of whatever page is loaded —
bypassing the Same-Origin Policy.
Full analysis: https://www.hunt-benito.com/blog/the-callback-that-outlived-the-page-cve-2026-78997-uc-browser-android-universal-xss/
# 1. Build the crafted URL (string assembly only)
$ python3 poc_url_builder.py alert --victim https://www.google.com
# 2. Watch the mechanism (vulnerable vs. fixed dispatch)
$ python3 callback_oracle.py
$ python3 callback_oracle.py --fixed
# 3. Observe in the real app (device/emulator you own, vulnerable build)
$ frida -U -f com.UCMobile.intl -l frida_hooks.js --no-pause
On a vulnerable build: open the crafted URL, let it navigate to the victim site, then dismiss the native login dialog (tap a sign-in option and press X, or close it any other way). The stored callback fires in the victim site's origin.
The URL builder performs no network I/O. The mtmsg.uc.cn reflection
and the bridge behavior are documented in the researcher's public
disclosure (referenced below). Only test against devices and network
positions you own or are explicitly authorized to test. Unauthorized
access to computer systems is illegal in most jurisdictions.
| File | Purpose |
|---|
poc_url_builder.py | Assembles the crafted mtmsg.uc.cn URL exactly as documented (reflected email parameter, base64 stage-2, account.openLoginWindow registration, navigation). Presets: alert (researcher's demo), demo (harmless), exfil (collector template). Assembles a string only — contacts no host. |
callback_oracle.py | Self-contained miniature of the vulnerable callback-dispatch mechanism (store → navigate → dispatch with empty URL guard). Run with --fixed to see the origin-bound remediation block the same chain. |
frida_hooks.js | Frida hook on WebView.evaluateJavascript for observing the dispatch in the real app on hardware you own. |