Description

NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting (UXSS) vulnerability that enables script execution within the origin of arbitrary websites.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-08T09:18:21.747Z",
  "pubdate": "2026-09-08T09:18:21.747Z",
  "executiveSummary": "NuBrowser is susceptible to a Universal Cross-Site Scripting (UXSS) vulnerability originating from improper input validation within the intent:// URI handling mechanism. The flaw resides in the S.browser_fallback_url field, which fails to enforce a protocol whitelist, allowing the injection of arbitrary javascript: pseudo-protocols.\nThis vulnerability enables an attacker to execute malicious JavaScript in the context of arbitrary web origins. By leveraging 302 redirects to deliver the payload, an attacker can bypass standard Same-Origin Policy (SOP) restrictions. The impact is critical, as successful exploitation permits unauthorized access to sensitive user data, including session tokens, cookies, and private information stored within the context of the targeted origin. This vulnerability does not require authentication to exploit, as it can be triggered via a crafted link delivered to a user of the affected browser. The attack complexity is relatively low, requiring only that the victim interacts with a malicious intent:// URI, thereby posing a significant risk to the integrity and confidentiality of web-based sessions.",
  "technicalDetails": "The vulnerability is rooted in an insufficient validation logic within NuBrowser’s intent URI processing component. When the browser receives an intent:// URI, it processes the S.browser_fallback_url parameter to determine the destination for a fallback navigation. The application fails to sanitize this parameter against a strict protocol whitelist, permitting the inclusion of dangerous URI schemes such as javascript:.\nThe exploitation flow initiates when an attacker crafts a malicious URL utilizing the intent:// scheme. The S.browser_fallback_url field is populated with a javascript: payload. To facilitate the execution, the attacker may employ an intermediate 302 redirect. When the browser attempts to process the fallback, it incorrectly treats the javascript: URI as a valid navigation target within the context of the current browsing session.\nBy executing this payload within the context of a legitimate origin—often through a crafted landing page or a redirected navigation—the attacker circumvents the browser's security boundaries. Since the execution occurs within the origin of an arbitrary website rather than the attacker's domain, the script gains access to the Document Object Model (DOM), local storage, and session cookies associated with the victim's authenticated sessions on that site. This represents a classic UXSS condition where the browser's navigation logic is subverted to perform unauthorized script injection.\nThere are no specific authentication or privilege requirements for the attacker to initiate this request, as it is delivered via common web vectors (e.g., hyperlinks or redirected HTTP requests). Once the script executes, the post-exploitation impact includes full control over the user's interaction with the targeted origin, potential credential theft, and the ability to perform actions on behalf of the user within that origin. The lack of validation effectively turns the browser into a vector for cross-origin attacks, rendering the SOP protections ineffective for the affected sessions."
}