EUVD-2026-72670
GHSA-5xg9-xgmv-w59x
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
UXSS crosses origin boundaries (S:C); script execution enables both data theft (C:H) and DOM manipulation (I:H); availability is unaffected.
Primary rating from Vendor (zte).
CVSS VectorVendor: zte
Lifecycle Timeline
1DescriptionCVE.org
NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting (UXSS) vulnerability that enables script execution within the origin of arbitrary websites.
AnalysisAI
Universal cross-site scripting in ZTE's NuBrowser (NebulaOS) allows remote unauthenticated attackers to execute arbitrary JavaScript within the origin of any website visited by the victim. The browser fails to enforce a protocol whitelist on the S.browser_fallback_url parameter of Android's intent:// URI scheme; by serving a 302 redirect pointing to a javascript: URL as the fallback destination, an attacker can trigger script execution under the target page's origin, breaking same-origin protections entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim is running a version of NuBrowser prior to V1.6.8 on a ZTE NebulaOS device, and that the victim navigates to or is redirected through attacker-controlled web content that triggers an intent:// URI with a crafted S.browser_fallback_url. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) captures network reachability and unauthenticated access correctly, but the S:U (unchanged scope) metric materially understates the impact of a UXSS: by design, the attack crosses origin boundaries, placing it in S:C territory. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is upgrading to NebulaOS Browser V1.6.8 or later, as documented in the ZTE bulletin at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/874505866159006721. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today