Executive brief
A security flaw exists in the smart sensing service of Huawei HarmonyOS devices, which manages automated device interactions based on environmental triggers. If exploited, this vulnerability could allow unauthorized access to sensitive service information, potentially compromising user privacy. This issue affects various Huawei smartphones and tablets running specific versions of HarmonyOS.
Technical details
A permission control vulnerability (CWE-840: Business Logic Error) exists in the Huawei HarmonyOS smart sensing service. The vulnerability is characterized by a high attack complexity and can be triggered over a network without requiring user interaction or prior authentication. Successful exploitation allows an attacker to impact the confidentiality, integrity, and availability of the service, though the primary impact is noted as service confidentiality. The issue is addressed in the May 2026 security update for HarmonyOS versions 5.1.0, 6.0.0, and 6.1.0.
Affected products
- Huawei HarmonyOS 6.1.0, 6.0.0, 5.1.0
Timeline
- 2026-05-15: disclosed
- 2026-05-15: advisory