CVE-2026-10510 - Vulnerability Details - OpenCVE

Cross-Site Scripting (XSS) in GeniexWebView component in Transsion AI Assistant Lifestyle application (com.transsion.aiassistantlifestyle) all versions on Android allows remote attacker to execute arbitrary JavaScript in the WebView context via crafted web_action_data URL parameter.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://security.tecno.com/SRC/securityUpdates

History

Tue, 02 Jun 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 02 Jun 2026 02:30:00 +0000

Type	Values Removed	Values Added
Description		Cross-Site Scripting (XSS) in GeniexWebView component in Transsion AI Assistant Lifestyle application (com.transsion.aiassistantlifestyle) all versions on Android allows remote attacker to execute arbitrary JavaScript in the WebView context via crafted web_action_data URL parameter.
Title		GeniexWebView XSS in com.transsion.aiassistantlifestyle
Weaknesses		CWE-79
References		https://security.tecno.com/SRC/securityUpdates

MITRE

Status: PUBLISHED

Assigner: TECNOMobile

Published: 2026-06-02T01:56:42.448Z

Updated: 2026-06-02T13:35:44.676Z

Reserved: 2026-06-01T03:45:49.551Z

Link: CVE-2026-10510

Vulnrichment

Updated: 2026-06-02T13:35:41.235Z

NVD

Status : Deferred

Published: 2026-06-02T03:16:15.933

Modified: 2026-06-02T14:50:37.260

Link: CVE-2026-10510

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10510", "assignerOrgId": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea", "state": "PUBLISHED", "assignerShortName": "TECNOMobile", "dateReserved": "2026-06-01T03:45:49.551Z", "datePublished": "2026-06-02T01:56:42.448Z", "dateUpdated": "2026-06-02T13:35:44.676Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea", "shortName": "TECNOMobile", "dateUpdated": "2026-06-02T01:56:42.448Z"}, "title": "GeniexWebView XSS in com.transsion.aiassistantlifestyle", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"vendor": "TECNO Mobile", "product": "com.transsion.aiassistantlifestyle", "versions": [{"status": "affected", "version": "v1.3.0.002"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Cross-Site Scripting (XSS) in GeniexWebView component in Transsion AI Assistant Lifestyle application (com.transsion.aiassistantlifestyle) all versions on Android allows remote attacker to execute arbitrary JavaScript in the WebView context via crafted web_action_data URL parameter.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Cross-Site Scripting (XSS) in GeniexWebView component in Transsion AI Assistant Lifestyle application (com.transsion.aiassistantlifestyle) all versions on Android allows remote attacker to execute arbitrary JavaScript in the WebView context via crafted web_action_data URL parameter."}]}], "references": [{"url": "https://security.tecno.com/SRC/securityUpdates"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-02T03:41:18.735178Z", "id": "CVE-2026-10510", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T13:35:44.676Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-10510", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T03:41:18.735178Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T13:35:41.235Z"}}], "cna": {"title": "GeniexWebView XSS in com.transsion.aiassistantlifestyle", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"vendor": "TECNO Mobile", "product": "com.transsion.aiassistantlifestyle", "versions": [{"status": "affected", "version": "v1.3.0.002"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://security.tecno.com/SRC/securityUpdates"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Cross-Site Scripting (XSS) in GeniexWebView component in Transsion AI Assistant Lifestyle application (com.transsion.aiassistantlifestyle) all versions on Android allows remote attacker to execute arbitrary JavaScript in the WebView context via crafted web_action_data URL parameter.", "supportingMedia": [{"type": "text/html", "value": "Cross-Site Scripting (XSS) in GeniexWebView component in Transsion AI Assistant Lifestyle application (com.transsion.aiassistantlifestyle) all versions on Android allows remote attacker to execute arbitrary JavaScript in the WebView context via crafted web_action_data URL parameter.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')"}]}], "providerMetadata": {"orgId": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea", "shortName": "TECNOMobile", "dateUpdated": "2026-06-02T01:56:42.448Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10510", "state": "PUBLISHED", "dateUpdated": "2026-06-02T13:35:44.676Z", "dateReserved": "2026-06-01T03:45:49.551Z", "assignerOrgId": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea", "datePublished": "2026-06-02T01:56:42.448Z", "assignerShortName": "TECNOMobile"}, "dataVersion": "5.2"}