CVE-2024-42041

> The com.videodownload.browser.videodownloader (aka AppTool-Browser-Video All Video Downloader) application
> 20-30.05.24 for Android allows an attacker to execute arbitrary JavaScript code via the acr.browser.lightning.DefaultBrowserActivity component.
>
> ------------------------------------------
>
> [VulnerabilityType Other]
> CWE-94: Improper Control of Generation of Code ('Code Injection')
>
> ------------------------------------------
>
> [Vendor of Product]
> AppTool-Browser-Video
>
> ------------------------------------------
>
> [Affected Product Code Base]
> "All Video Downloader" com.videodownload.browser.videodownloader - Version: 20-30.05.24
>
> ------------------------------------------
>
> [Affected Component]
> Exported Activity: acr.browser.lightning.DefaultBrowserActivity
>
> ------------------------------------------
>
> [Attack Type]
> Remote
>
> ------------------------------------------
>
> [Impact Code execution]
> true
>
> ------------------------------------------
>
> [Impact Information Disclosure]
> true
>
> ------------------------------------------
>
> [Attack Vectors]
> This vulnerability allows an attacker to execute arbitrary JavaScript code within the context of the application's WebView by sending a crafted intent.
>
> ------------------------------------------
>
> [Reference]
> https://play.google.com/store/apps/details?id=com.videodownload.browser.videodownloader
> https://github.com/actuator/com.videodownload.browser.videodownloader/blob/main/20-30.05.24.md
> 
> ------------------------------------------
>
> [Discoverer]
> Edward Warren