CVE-2023-42471

The wave.ai.browser application through 1.0.35 for Android allows a remote attacker to execute arbitrary JavaScript code via a crafted intent. It contains a manifest entry that exports the wave.ai.browser.ui.splash.SplashScreen activity. This activity uses a WebView component to display web content and doesn't adequately validate or sanitize the URI or any extra data passed in the intent by a third party application (with no permissions).

• CWE-94

• https://github.com/actuator/cve/blob/main/CVE-2023-42471Third Party Advisory
• https://github.com/actuator/wave.ai.browser/blob/main/CWE-94.mdExploit
• https://github.com/actuator/wave.ai.browser/blob/main/poc.apkExploit
• https://github.com/actuator/cve/blob/main/CVE-2023-42471Third Party Advisory
• https://github.com/actuator/wave.ai.browser/blob/main/CWE-94.mdExploit
• https://github.com/actuator/wave.ai.browser/blob/main/poc.apkExploit

Published

Sep 11, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42465Sudo before 1.9.15 might allow row hammer attacks (for authe…7
• CVE-2023-42467QEMU through 8.0.0 could trigger a division by zero in scsi_…5.5
• CVE-2023-42468The com.cutestudio.colordialer application through 2.1.8-2 f…5.3
• CVE-2023-42469The com.full.dialer.top.secure.encrypted application through…3.3
• CVE-2023-4247The GiveWP plugin for WordPress is vulnerable to Cross-Site …5.4
• CVE-2023-42470The Imou Life com.mm.android.smartlifeiot application throug…9.8
• CVE-2023-42472Due to insufficient file type validation, SAP BusinessObject…7.3
• CVE-2023-42473S/4HANA Manage (Withholding Tax Items) - version 106, does n…5.4
• CVE-2023-42474SAP BusinessObjects Web Intelligence - version 420, has a UR…5.4
• CVE-2023-42475The Statutory Reporting application has a vulnerable file st…4.3
• CVE-2023-42476SAP Business Objects Web Intelligence - version 420, allows…6.8
• CVE-2023-42477SAP NetWeaver AS Java (GRMG Heartbeat application) - version…6.5