CVE-2024-46960

The ASD com.rocks.video.downloader (aka HD Video Downloader All Format) application through 7.0.129 for Android allows an attacker to execute arbitrary JavaScript code via the com.rocks.video.downloader.MainBrowserActivity component.
>
> ------------------------------------------
>
> [VulnerabilityType Other]
> CWE-94: Improper Control of Generation of Code (Code Injection)
>
> ------------------------------------------
>
> [Vendor of Product]
> ASD Dev Video Player for All Format
>
> ------------------------------------------
>
> [Affected Product Code Base]
> HD Video Downloader All Format com.rocks.video.downloader - Version 7.0.129
>
> ------------------------------------------
>
> [Affected Component]
> MainBrowserActivity within the com.rocks.video.downloader application (version 7.0.129).
>
> ------------------------------------------
>
> [Attack Type]
> Remote
>
> ------------------------------------------
>
> [Impact Code execution]
> true
>
> ------------------------------------------
>
> [Impact Escalation of Privileges]
> true
>
> ------------------------------------------
>
> [Attack Vectors]
> The vulnerability can be exploited remotely by sending a specially crafted intent to execute JavaScript within the WebView.
>
> ------------------------------------------
>
> [Reference]
> https://play.google.com/store/apps/details?id=com.rocks.video.downloader
> https://github.com/actuator/com.rocks.video.downloader-/blob/main/com.rocks.video.downloader.MainBrowserActivity-7.0.129.gif
>
> ------------------------------------------
>
> [Discoverer]
> Edward Warren