Try Avast free and Malwarebytes , one after another (not 2 installed in the same time).
Try to move the app masked as com.securitycore.miui_t to SD card, then scan your phone again.
I removed an "insane" pop-up linker (no matter what browser I used) which, instead acting like an activity by default (a malware activity) just used text displayed on webpage ( reading html meta tags ) and added link with advertorial content (manipulating content by adding div contents) or opening random links even if I visited “legit” and “clean” sites.
I recommended Avast for it's heuristic engine (IMHO better than AVG). Malware bytes actually marks threats and help remove some “non-detectable” adware (details about heuristic engine vs. databases containing signatures of viral code is out of the scope here).
Having in fact an extended experience with those kind of threats, my advice is a first step for taking countermeasures against this malicious object (script). I also see the user has a strange object acting like overwriting content or redirecting page.
So, after scanning with those 2 tools, the user may come back telling: none worked. How we must interpret this second problem? I think the key in this case is thinking about “where” antivirus and other products used did not look. As obvious, there can be two major places:
/system root folders. So, in case we still have troubles after scanning with some tools the solution which comes to mind is to go in
/system folders and manually remove application which we suspect (browser application, in our case).
Being aware the user has a non-rooted device, a simple solution is to use another browser after deleting/uninstall browser app which caused trouble. I hope the user has original ROM by Xiaomi and not a "modified" one (there were rumors about malware packed inside 'Xioami' counterfeit rooms, even if the device looks legit).
Readings for reference: