Unpatched Flaw in UC Browser Apps Could Let Hackers Launch Phishing Attacks

A bug bounty hunter has discovered and publicly disclosed
details of an unpatched browser address bar spoofing vulnerability
that affects popular Chinese UC Browser and UC Browser
Mini apps for Android.

Developed by Alibaba-owned UCWeb, UC Browser is one of the most
popular mobile browsers, specifically in China and India, with a
massive user base of more than half a billion users worldwide.

According to the details security researcher Arif Khan shared with The Hacker News,
the vulnerability resides in the way User Interface on both
browsers handles a special built-in feature that was otherwise
designed to improve users Google search experience.
^[1]

The vulnerability, which has yet not assigned any CVE identifier,
could allow an attacker to control URL string displayed in the
address bar, eventually letting a malicious website to pose as some
legitimate site.

The vulnerability affects the latest UC Browser version
12.11.2.1184 and UC Browser Mini version 12.10.1.1192—that is
currently being used by over 500 million and 100 million users
respectively, according to Google Play Store.

Though the flaw is similar to the one Khan discovered last month
in the MI
browser^[2] that comes pre-installed
on Xiaomi smartphones and the Mint browser, phishing pages served
using the newly discovered vulnerability in UC Browser still leaves
some indicators that vigilant users can spot.

When users search something on “google.com” using UC Browsers,
the browsers automatically remove the domain from the address bar
and rewrite it only to display the search query string to the
user.

Arif found that the pattern matching logic used by UC Browsers is
insufficient and can be abused by attackers by simply creating
subdomains on their own domain, as
“www.google.com.phishing-site.com?q=www.facebook.com,” tricking
browsers into thinking that the given site is “www.google.com” and
the search query is “www.facebook.com.”

The URL Address Bar spoofing vulnerability can be used to easily
trick UC Browser users into thinking they’re visiting a trusted
website when actually being served with a phishing page, as shown
in the video demonstration.

Unlike Xiaomi browsers
flaw, the UC browsers vulnerability does not allow an attacker
to spoof SSL indicator, which is a basic and important factor that
users cross-check to determine if a site is fake or legit.
The Hacker News has independently verified the vulnerability and
can confirm it works on the latest versions of both web browsers
available at the time of writing.

What’s interesting? The researcher also mentioned that some old
and other versions of UC Browser and UC Browser Mini are not
affected by this URL Address Bar spoofing vulnerability, which
suggests that a “new feature might have been added to this browser
sometime back which is causing this issue.”

Khan responsibly reported the vulnerability to the UC Browser
security team more than a week ago, but the company has not yet
addressed the issue and simply put an Ignore status on his
report.

UC Browser was in the news just over a month ago when
researchers found a “hidden”
feature^[5] in its Android app that
could have been exploited by attackers to remotely download and
execute malicious code on Android phones and hijack them.

^[4]