Executive brief
A security vulnerability exists in the theme setting module of Huawei mobile devices. This flaw could allow an attacker to bypass intended permission controls, potentially leading to the unauthorized disclosure of sensitive service information. Users are advised to apply the April 2026 security updates to protect their devices.
Technical details
An improper permission control vulnerability (CWE-275) exists in the theme setting module of Huawei's HarmonyOS and EMUI operating systems. The vulnerability is characterized by a high attack complexity and requires user interaction, typically occurring via a local attack vector. Successful exploitation allows an attacker to bypass access controls, impacting the confidentiality of the service and potentially causing minor impacts to integrity and availability. The issue is addressed in the Huawei April 2026 security bulletin.
Affected products
- Huawei HarmonyOS 4.0.0, 4.2.0, 4.3.0, 4.3.1
- Huawei EMUI 14.0.0, 14.2.0, 15.0.0
Timeline
- 2026-04-13: disclosed
- 2026-04-13: advisory: Huawei published the security bulletin.