« Volver al listado

CVE-2026-10510

Estado: AplazadaMedia (6.1)—

Cross-Site Scripting (XSS) in GeniexWebView component in Transsion AI Assistant Lifestyle application (com.transsion.aiassistantlifestyle) all versions on Android allows remote attacker to execute arbitrary JavaScript in the WebView context via crafted web_action_data URL parameter.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Transsion — AiassistantlifestyleAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-10510",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-10510",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-02T03:41:18.735178Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea",
      "affectedData": [
        {
          "vendor": "TECNO Mobile",
          "product": "com.transsion.aiassistantlifestyle",
          "versions": [
            {
              "status": "affected",
              "version": "v1.3.0.002"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-02T03:16:15.933",
  "references": [
    {
      "url": "https://security.tecno.com/SRC/securityUpdates",
      "source": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-Site Scripting (XSS) in GeniexWebView component in Transsion AI Assistant Lifestyle application (com.transsion.aiassistantlifestyle) all versions on Android allows remote attacker to execute arbitrary JavaScript in the WebView context via crafted web_action_data URL parameter."
    },
    {
      "lang": "es",
      "value": "Cross-Site Scripting (XSS) en el componente GeniexWebView en la aplicación Transsion AI Assistant Lifestyle (com.transsion.aiassistantlifestyle) todas las versiones en Android permite a un atacante remoto ejecutar JavaScript arbitrario en el contexto de WebView a través de un parámetro URL web_action_data manipulado."
    }
  ],
  "lastModified": "2026-07-22T19:10:00.120",
  "sourceIdentifier": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea"
}