CVE-2024-46962

The SYQ com.downloader.video.fast (aka Master Video Downloader) application through 2.0 for Android allows an attacker to execute arbitrary JavaScript code via the com.downloader.video.fast.SpeedMainAct component.
>
> ------------------------------------------
>
> [VulnerabilityType Other]
> CWE-94: Improper Control of Generation of Code (Code Injection)
>
> ------------------------------------------
>
> [Vendor of Product]
> SYQ
>
> ------------------------------------------
>
> [Affected Product Code Base]
> Master Video Downloader com.downloader.video.fast - Version 2.0
>
> ------------------------------------------
>
> [Affected Component]
> SpeedMainAct within the com.downloader.video.fast application (version 2.0).
>
> ------------------------------------------
>
> [Attack Type]
> Remote
>
> ------------------------------------------
>
> [Impact Code execution]
> true
>
> ------------------------------------------
>
> [Impact Escalation of Privileges]
> true
>
> ------------------------------------------
>
> [Attack Vectors]
> The vulnerability is triggered through a specially crafted intent that results in arbitrary JavaScript execution within the WebView.
>
> ------------------------------------------
>
> [Reference]
> https://play.google.com/store/apps/details?id=com.downloader.video.fast
> https://github.com/actuator/com.downloader.video.fast/blob/main/com.downloader.video.fast-SpeedMainAct-2.0.gif
>
> ------------------------------------------
>
> [Discoverer]
> Edward Warren