SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-86550

MEDIUM · CVSS 6.5 EPSS 0.27%

Source: NVD + CISA KEV + EPSS · Published 2026-09-08 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The vulnerability affects Java applications utilizing NuBrowser, which fails to validate the protocol whitelist for the S.browser_fallback_url field, allowing attackers to inject malicious javascript: URLs through 302 redirects. This leads to a universal cross-site scripting (UXSS) vulnerability, enabling unauthorized script execution within the context of arbitrary websites. Developers and security teams using Java with NuBrowser should prioritize addressing this issue to mitigate potential exploitation risks.

CVE
CVE-2026-86550
Severity
MEDIUM
CVSS
6.5
EPSS
0.27%
Java

Original NVD Description

NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting (UXSS) vulnerability that enables script execution within the origin of arbitrary websites.