DuckDuckGo Browser UXSS Flaw in Auto Consent JS Bridge Enables Cross-Origin Code Execution

The report describes a critical UXSS vulnerability (CVSS 8.6) in the DuckDuckGo Android browser's AutoconsentAndroid JS bridge that accepted messages from any frame and used webView.evaluateJavascript(...) to run code in the top-level page, allowing cross-origin iframes to execute arbitrary JavaScript; the issue was responsibly disclosed via HackerOne and has been patched, and users should update the app to mitigate risk.