A cross-site scripting vulnerability in the Lenovo Browser poses a risk of sensitive information disclosure to users who visit malicious web pages.

This is a cross-site scripting (CWE-79) vulnerability where the browser fails to properly neutralize input during web page generation. The vulnerability is exploitable by an unauthenticated attacker who directs a user to view specially crafted content.

The ability for an attacker to execute arbitrary scripts in the context of a user browser session leads to the potential theft of session cookies, sensitive credentials, or personal information. With a CVSS score of 7.4, this vulnerability represents a high risk to user data privacy and organizational security. Successful exploitation could result in unauthorized access to web-based accounts or compromise of internal web applications accessed by the affected user.

Immediate Action: The vendor has indicated that the Lenovo Browser component is updated automatically; verify that your browser instance is running the latest version.

Proactive Monitoring: Monitor for unusual browser behavior or unexpected script execution errors when navigating to untrusted websites.

Compensating Controls: Ensure that browser-based security settings are hardened and consider using protective extensions that mitigate XSS attacks.

Public Exploit Available: No (exploit_available: false)

Although this vulnerability is addressed through automatic updates, administrators should verify that all managed systems have successfully received the latest browser patch. Users should exercise caution when navigating to unknown or suspicious web pages, as this remains the primary vector for triggering the vulnerability.