HarmonyOS ArkWeb CVE-2026-101175

Exploitation requires the victim to load attacker-controlled web content into the ArkWeb module (HarmonyOS's web-rendering component) - the CVSS UI:R metric confirms required user interaction, so this is not a silent remote attack. No authentication is required (PR:N), but the attacker depends on the user opening or navigating to the malicious content. The impact is limited to availability (A:L): a crash or unavailability of the web component, with no confidentiality or integrity effect and no code execution. The specific web feature or input that triggers the dereference is not described in the available sources.

This is a genuinely low-to-moderate priority issue despite being internet-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) scores 4.3 (Medium) and the signals are internally consistent: network vector with low complexity and no privileges, but exploitation requires user interaction (UI:R) and the only impact is limited availability (A:L) - a crash or hang of the ArkWeb web-rendering component, not code execution or data exposure. The vuln.today decision label is 'this_month', indicating routine remediation rather than urgent action. No EPSS score was supplied, there is no CISA KEV listing, and no proof-of-concept or exploit reference is present among the sources (only Huawei vendor bulletins) - so exploitation status is 'no public exploit identified at time of analysis'. CWE-248 (uncaught exception) aligns with a null pointer dereference producing a denial-of-service condition. There is no conflict among the signals; the main caveat is simply that no exploitation-probability data (EPSS) was provided to quantify likelihood. The description does not state how the null pointer dereference is triggered, so the exact mechanism is not described in the available sources.

An attacker crafts a malicious web page that triggers the null pointer dereference in the ArkWeb module when rendered. A HarmonyOS user is lured into opening the page (satisfying the required user interaction), causing the web component to crash and denying availability of the browsing/web-rendering function. No public exploit code is identified, and impact is limited to a denial-of-service condition.