Back Cybersecuritynews

DuckDuckGo Browser UXSS Flaw in Auto Consent JS Bridge Enables Cross

Cybersecuritynews •Abinaya • March 2, 2026

A critical Universal Cross-Site Scripting (UXSS) vulnerability was recently discovered in the DuckDuckGo Android browser. This flaw allowed untrusted, cross-origin iframes to execute arbitrary JavaScript in the top-level origin, tracked with a high-severity CVSS score of 8.6. The vulnerability was originally detailed in a Medium post by security researcher Dhiraj Mishra. The vulnerability stems from […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

uXSS Vulnerability in DuckDuckGo Browser's AutoConsent JS Bridge Discovered A Universal Cross-Site Scripting (uXSS) vulnerability has been identified in the DuckDuckGo browser, specifically within the AutoConsent JavaScript bridge. This flaw allows attackers to exploit the bridge, potentially compromising user security. Users of the DuckDuckGo browser are affected by this vulnerability. 3 sources 31

Extracted Entities

DuckDuckGo Browser UXSS Flaw in Auto Consent JS Bridge Enables Cross

The full story

Extracted Entities

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (2)