Unblu Spark EUVD-2026-104958

Exploitation requires an agent to actively join an embedded co-browsing session initiated by the attacker operating in the visitor role, and requires the agent's browser to render attacker-supplied co-browsed page content as HTML (the specific injection point). No authentication is needed by the attacker (visitor role, PR:N), but the attack is limited by the need for live agent participation (UI:P) - purely automated or victimless exploitation is not possible. Mobile co-apping is explicitly not affected, which narrows the attack surface to the embedded co-browsing feature; both on-premises and cloud deployments of the listed versions are in scope.

This is a genuine, credible-priority vulnerability rather than an inflated high-CVSS artifact, though it is conditional rather than mass-exploitable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N) scores 8.6 and is internally consistent with the description: a visitor-role actor needs no authentication (PR:N) and reaches the target over the network (AV:N), but exploitation is gated by passive user interaction (UI:P) - an agent must actively join the attacker's co-browsing session. The high confidentiality and integrity impact (VC:H/VI:H) is justified because arbitrary JavaScript executes under the agent's authenticated identity in the Agent Desk / Single Conversation Desk, enabling session hijacking and actions as the agent. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no public exploit identified at time of analysis; the absence of these signals means real-world exploitation likelihood is currently unquantified. The main contrast is between a high technical-impact score and the social-engineering/operational dependency (an agent must be lured into co-browsing with a hostile visitor), which realistically constrains this to targeted abuse of live support/engagement workflows rather than opportunistic mass exploitation.

An attacker posing as a legitimate visitor initiates an embedded co-browsing session with a support agent and loads attacker-controlled page content containing a crafted HTML/JavaScript payload. When the agent joins and their browser renders the co-browsed content, the script executes in the context of the agent's authenticated Agent Desk session, letting the attacker act as the agent or steal session data. No public exploit code is identified at time of analysis, and the network attack vector with low complexity makes execution straightforward once an agent is engaged.