Executive brief
A security vulnerability has been identified in the file system of Huawei mobile devices and smart screens. This flaw could allow an attacker to bypass standard permission controls, potentially leading to the unauthorized access or modification of sensitive user data. Successful exploitation could compromise the confidentiality and integrity of information stored on the device.
Technical details
A permission control vulnerability exists within the file system component of Huawei's HarmonyOS and EMUI. Classified as a business logic error (CWE-840), the flaw allows for the bypass of intended access restrictions. The attack vector is local, requiring a user to perform a specific action (User Interaction: Required) to trigger the exploit. If successful, an attacker can achieve high impact across confidentiality, integrity, and availability. The vulnerability affects multiple versions of HarmonyOS (4.0.0 through 4.3.1) and EMUI (14.0.0 through 15.0.0). Patches were released as part of the July 2026 security update.
Affected products
- Huawei HarmonyOS 4.0.0, 4.2.0, 4.3.0, 4.3.1
- Huawei EMUI 14.0.0, 14.2.0, 15.0.0
Timeline
- 2026-07-08: patched: Huawei released security bulletins detailing the fix.
- 2026-07-15: disclosed: CVE record published and NVD dataset updated.