Executive brief
A security flaw exists in the security control module of Huawei HarmonyOS, which is used in smartphones, tablets, and PCs. If exploited, this vulnerability could allow unauthorized access to sensitive service information, potentially compromising user privacy. To be successful, an attacker would typically need to trick a user into performing a specific action on the device.
Technical details
A permission control vulnerability (CWE-840: Business Logic Error) exists in the security control module of Huawei HarmonyOS. The flaw is locally exploitable and requires user interaction (UI:R), meaning an attacker must convince a user to perform a specific action to trigger the bug. Successful exploitation allows an attacker to bypass intended access controls to read sensitive service data, impacting confidentiality. The vulnerability affects HarmonyOS versions 5.1.0 and 6.0.0 on mobile devices and version 6.0.0 on PCs. Huawei has released security updates in the May 2026 bulletin to address this issue.
Affected products
- Huawei HarmonyOS 6.0.0, 5.1.0
Timeline
- 2026-05-07: patched: Huawei released security bulletin updates
- 2026-05-15: disclosed: NVD publication date