Executive brief
Huawei's HarmonyOS and EMUI operating systems contain a permission control flaw in the Settings module that could allow an attacker to gain unauthorized access to sensitive information. Successful exploitation may expose user data stored within the Settings application, compromising service confidentiality and user privacy.
Technical details
This is a permission control vulnerability (improper access control) in the Settings module of HarmonyOS and EMUI. The vulnerability allows unauthorized access to confidential settings information due to inadequate permission validation. The exact attack vector and preconditions are not detailed in the advisory, but the medium severity rating and confidentiality impact suggest the vulnerability requires some level of access or user interaction to exploit. No patch details are provided in the advisory, though Huawei is addressing this through monthly security updates for affected versions.
Affected products
- Huawei HarmonyOS 4.0.0, 4.2.0, 4.3.0, 4.3.1, 4.3.3
- Huawei EMUI 14.0.0, 14.2.0, 15.0.0, 16.0.0
Timeline
- 2026-09-09: disclosed: CVE-2026-49309 published
- 2026-09-05: advisory: Huawei security bulletin released