Cross-Site Scripting Vulnerability in Transsion AI Assistant Lifestyle Application
CVE-2026-10510

6.1MEDIUM

Key Information:

Vendor: Tecno Mobile
Status: Com.transsion.aiassistantlifestyle
Vendor: CVE Published:; 2 June 2026

🔔 Create Tecno Mobile Vulnerability Alert

What is CVE-2026-10510?

The Transsion AI Assistant Lifestyle application for Android contains a Cross-Site Scripting (XSS) vulnerability within its GeniexWebView component. This flaw allows remote attackers to inject and execute arbitrary JavaScript code by manipulating the 'web_action_data' URL parameter. Exploitation of this vulnerability can lead to unauthorized actions being performed within the context of the application, posing a significant risk to users.

Affected Version(s)

com.transsion.aiassistantlifestyle v1.3.0.002

References

https://security.tecno.com/SRC/securityUpdates

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 2, 2026
Vulnerability Reserved
Jun 1, 2026

CVE-2026-10510 Data

JSON