Cross‑Site Scripting was discovered in the GeniexWebView component of Transsion AI Assistant Lifestyle for Android. The flaw allows a remote attacker to supply a crafted web_action_data URL parameter that is passed unsanitized to the WebView. By injecting JavaScript into that parameter, an attacker can execute arbitrary code in the context of the application, potentially leaking sensitive data or hijacking the user’s session.

All Android versions of TECNO Mobile’s com.transsion.aiassistantlifestyle application are affected. The vulnerability exists across all releases of the app currently on the market.

The CVSS score is 6.1, and the EPSS score is < 1%. The issue is categorized as a classic XSS which can be triggered by an attacker who controls a link or URL. Because the attack requires only the delivery of a malicious web_action_data value, the risk is high if users click suspicious links or open URLs from untrusted sources. The vulnerability is not listed in CISA’s KEV catalog, yet it remains a significant security concern until a vendor patch is issued.