CVE-2024-9285: Tu Yafeng Via Browser Javascript Bridge cross site scripting

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-27 · updated 2026-06-17
Weakness: CWE-79

Description

A vulnerability was found in Tu Yafeng Via Browser up to 5.9.0 on Android. It has been rated as problematic. This issue affects some unknown processing of the component Javascript Bridge. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.

Affected products

Tu Yafeng Via Browser: 5.0, 5.1, 5.2, 5.3, 5.4, 5.5 (+4)

References

https://modzero.com/en/advisories/mz-25-01-via-browser/
https://modzero.com/static/MZ-25-01_modzero_uXSS-in-Via-Browser.pdf
https://vuldb.com/?ctiid.297863
https://vuldb.com/?id.297863

Get alerted when CVE-2024-9285 or the next vulnerability affects your stack