CVE-2024-46965

The DS allvideo.downloader.browser (aka Fast Video Downloader: Browser) application through 1.6-RC1 for Android allows an attacker to execute arbitrary JavaScript code via the allvideo.downloader.browser.DefaultBrowserActivity component.
>
> ------------------------------------------
>
> [VulnerabilityType Other]
> CWE-94: Improper Control of Generation of Code (Code Injection)
>
> ------------------------------------------
>
> [Vendor of Product]
> DS Browsers
>
> ------------------------------------------
>
> [Affected Product Code Base]
> Fast Video Downloader: Browser allvideo.downloader.browser - version 1.6-RC1
>
> ------------------------------------------
>
> [Affected Component]
> DefaultBrowserActivity within the allvideo.downloader.browser application (version 1.6-RC1).
>
> ------------------------------------------
>
> [Attack Type]
> Remote
>
> ------------------------------------------
>
> [Impact Code execution]
> true
>
> ------------------------------------------
>
> [Impact Escalation of Privileges]
> true
>
> ------------------------------------------
>
> [Attack Vectors]
> Remote attackers can exploit this vulnerability by crafting a specially formatted intent that executes arbitrary JavaScript code in the WebView context.
>
> ------------------------------------------
>
> [Reference]
> https://play.google.com/store/apps/details?id=allvideo.downloader.browser
> https://github.com/actuator/allvideo.downloader.browser/blob/main/allvideo.downloader.browser.DefaultBrowserActivity-v1.6-RC1.gif
> ------------------------------------------
> [Discoverer]
> Edward Warren