CVE-2026-10510

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10510", "assignerOrgId": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea", "state": "PUBLISHED", "assignerShortName": "TECNOMobile", "dateReserved": "2026-06-01T03:45:49.551Z", "datePublished": "2026-06-02T01:56:42.448Z", "dateUpdated": "2026-06-02T13:35:44.676Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea", "shortName": "TECNOMobile", "dateUpdated": "2026-06-02T01:56:42.448Z"}, "title": "GeniexWebView XSS in com.transsion.aiassistantlifestyle", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"vendor": "TECNO Mobile", "product": "com.transsion.aiassistantlifestyle", "versions": [{"status": "affected", "version": "v1.3.0.002"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Cross-Site Scripting (XSS) in GeniexWebView component in Transsion AI Assistant Lifestyle application (com.transsion.aiassistantlifestyle) all versions on Android allows remote attacker to execute arbitrary JavaScript in the WebView context via crafted web_action_data URL parameter.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Cross-Site Scripting (XSS) in GeniexWebView component in Transsion AI Assistant Lifestyle application (com.transsion.aiassistantlifestyle) all versions on Android allows remote attacker to execute arbitrary JavaScript in the WebView context via crafted web_action_data URL parameter."}]}], "references": [{"url": "https://security.tecno.com/SRC/securityUpdates"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-02T03:41:18.735178Z", "id": "CVE-2026-10510", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T13:35:44.676Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-10510", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T03:41:18.735178Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T13:35:41.235Z"}}], "cna": {"title": "GeniexWebView XSS in com.transsion.aiassistantlifestyle", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"vendor": "TECNO Mobile", "product": "com.transsion.aiassistantlifestyle", "versions": [{"status": "affected", "version": "v1.3.0.002"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://security.tecno.com/SRC/securityUpdates"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Cross-Site Scripting (XSS) in GeniexWebView component in Transsion AI Assistant Lifestyle application (com.transsion.aiassistantlifestyle) all versions on Android allows remote attacker to execute arbitrary JavaScript in the WebView context via crafted web_action_data URL parameter.", "supportingMedia": [{"type": "text/html", "value": "Cross-Site Scripting (XSS) in GeniexWebView component in Transsion AI Assistant Lifestyle application (com.transsion.aiassistantlifestyle) all versions on Android allows remote attacker to execute arbitrary JavaScript in the WebView context via crafted web_action_data URL parameter.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')"}]}], "providerMetadata": {"orgId": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea", "shortName": "TECNOMobile", "dateUpdated": "2026-06-02T01:56:42.448Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10510", "state": "PUBLISHED", "dateUpdated": "2026-06-02T13:35:44.676Z", "dateReserved": "2026-06-01T03:45:49.551Z", "assignerOrgId": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea", "datePublished": "2026-06-02T01:56:42.448Z", "assignerShortName": "TECNOMobile"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "com.transsion.aiassistantlifestyle", "vendor": "TECNO Mobile", "versions": [{"status": "affected", "version": "v1.3.0.002"}]}], "source": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-Site Scripting (XSS) in GeniexWebView component in Transsion AI Assistant Lifestyle application (com.transsion.aiassistantlifestyle) all versions on Android allows remote attacker to execute arbitrary JavaScript in the WebView context via crafted web_action_data URL parameter."}, {"lang": "es", "value": "Cross-Site Scripting (XSS) en el componente GeniexWebView en la aplicaci\u00f3n Transsion AI Assistant Lifestyle (com.transsion.aiassistantlifestyle) todas las versiones en Android permite a un atacante remoto ejecutar JavaScript arbitrario en el contexto de WebView a trav\u00e9s de un par\u00e1metro URL web_action_data manipulado."}], "id": "CVE-2026-10510", "lastModified": "2026-07-22T19:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10510", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-02T03:41:18.735178Z", "version": "2.0.3"}}]}, "published": "2026-06-02T03:16:15.933", "references": [{"source": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea", "url": "https://security.tecno.com/SRC/securityUpdates"}], "sourceIdentifier": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v1.3.0.002"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "com.transsion.aiassistantlifestyle", "source": "cna", "vendor": "TECNO Mobile"}, "product": "com.transsion.aiassistantlifestyle", "vendor": "tecno"}], "created": "2026-06-02T03:30:26.147050+00:00", "updated": "2026-06-02T20:52:11.434141+00:00", "vendors": ["tecno", "tecno$PRODUCT$com.transsion.aiassistantlifestyle"]}