Huawei HarmonyOS CVE-2026-101178

Exploitation requires local access to a Huawei HarmonyOS or EMUI device - in practice a malicious or compromised application running on the device - targeting the autofill service module whose permission controls are flawed. The CVSS vector mandates user interaction (UI:R), so the victim must perform an action such as invoking autofill for the data leak to occur; it is not triggerable remotely or without user involvement. The attack is confined to the local attack surface (AV:L), which meaningfully limits scale compared with a network-exploitable flaw. The exact configuration or app-permission precondition that enables the bypass is not described in the available sources.

This is a moderate-severity information-disclosure issue (vendor CVSS 6.6) rather than an urgent priority. The CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L, meaning exploitation requires local access to the device (typically a malicious or compromised app already present) plus user interaction, which substantially limits remote mass exploitation despite the C:H confidentiality rating. There is no CISA KEV listing, no EPSS score supplied, and no public exploit identified at time of analysis, so all exploitation signals are quiet. The vuln.today decision label is 'this_month', consistent with a real but non-emergency fix cadence. Note a minor internal inconsistency worth verifying with the vendor: the issue is classified CWE-200 (information disclosure) and the stated impact is confidentiality only, yet the CVSS vector also asserts I:L and A:L integrity/availability impact that the description does not substantiate.

A user installs or runs a malicious application on a Huawei HarmonyOS or EMUI device; because the autofill service enforces permission controls improperly, the app can observe or retrieve autofill data (such as saved credentials or form entries) belonging to other apps when the user triggers an autofill interaction. The attack is local and depends on user interaction (UI:R), and no public exploit code has been identified. The precise trigger mechanism is not described in the available sources.