CVE-2024-46961

EUVD-2024-42163
The Inshot com.downloader.privatebrowser (aka Video Downloader - XDownloader) application through 1.3.5 for Android allows an attacker to execute arbitrary JavaScript code via the com.downloader.privatebrowser.activity.PrivateMainActivity component.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 38%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
inshot.comx_downloader
𝑥
< 1.3.5_for_android
ADP
Common Weakness Enumeration
References
https://github.com/actuator/com.downloader.privatebrowser/blob/main/CVE-2024-46961