CVE-2026-86550 ZTE CVE debrief

Who should care

Defenders responsible for NuBrowser installations, web application security, and vulnerability management should assess exposure and prioritize patching to prevent potential exploitation. This includes verifying NuBrowser installations, reviewing compensating controls, and monitoring usage to detect potential security incidents. Security teams should also track exceptions and retest remediated assets to ensure the vulnerability is fully addressed.

Why it matters

The UXSS vulnerability in NuBrowser allows attackers to inject javascript: URLs, enabling script execution within arbitrary website origins. Defenders should prioritize verifying and patching NuBrowser installations to prevent potential exploitation.

• Potential script execution within arbitrary website origins
• Possible exploitation via injected javascript: URLs
• Verification of NuBrowser installations and patching priority

Technical summary

The UXSS vulnerability in NuBrowser allows attackers to inject javascript: URLs via 302 redirects, enabling script execution within the origin of arbitrary websites. This vulnerability is caused by a lack of protocol whitelist validation for the S.browser_fallback_url field of intent://. The vulnerability has a medium impact, with a CVSS score of 6.5, and defenders should prioritize verifying and patching NuBrowser installations to prevent potential exploitation. The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is limited.

Defensive priority

Defenders should prioritize verifying and patching NuBrowser installations to prevent potential script execution within the origin of arbitrary websites.

Recommended defensive actions

• Verify and patch NuBrowser installations to prevent potential script execution
• Implement additional security measures to detect and prevent exploitation attempts
• Monitor NuBrowser usage and update to a patched version if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the UXSS vulnerability in NuBrowser, but additional information on affected versions, exploitation, and remediation is limited. Further verification is needed to determine the full scope of the vulnerability and to identify potential mitigations. Defenders should verify NuBrowser installations and assess exposure to prioritize patching.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.