Executive brief
A security flaw has been identified in the Settings module of Huawei mobile devices running HarmonyOS and EMUI. This vulnerability could allow an attacker to bypass intended permission controls, potentially leading to the unauthorized disclosure of sensitive user information. To be successful, the attack requires a user to perform a specific action, such as interacting with a malicious application or link.
Technical details
A permission control vulnerability (CWE-200) exists in the Settings module of Huawei's HarmonyOS and EMUI operating systems. The flaw is characterized by improper enforcement of access controls, which could allow a local attacker to gain unauthorized access to sensitive data. The attack vector is classified as local with a requirement for user interaction (UI:R), suggesting that an attacker might need to trick a user into executing a malicious app or visiting a crafted site to trigger the bypass. Successful exploitation primarily impacts confidentiality. Huawei has addressed this in their July 2026 security update.
Affected products
- Huawei HarmonyOS 4.0.0, 4.2.0, 4.3.0, 4.3.1
- Huawei EMUI 14.0.0, 14.2.0, 15.0.0
Timeline
- 2026-07-08: patched: Huawei released the July 2026 security bulletin addressing the issue.
- 2026-07-15: advisory: NVD published the CVE details.