Vivo Kids Mode CVE-2026-15365

Physical possession of the Vivo device is required (AV:P) - remote exploitation is not possible. Kids Mode must be active and enabled on the device; if the feature is disabled or the device is in normal operation mode, the vulnerability is not exploitable. The attacker must interact with a specific feature's pop-up within the Kids Mode UI to trigger the logic flaw. No privileges are required per CVSS PR:N, but the physical access constraint effectively limits the attacker population to individuals who hold the device. Exploitation is further bounded by the requirement that the target feature be reachable within the Kids Mode session without prior password entry.

Real-world risk is low in any organizational or enterprise context. The CVSS 4.0 vector AV:P/AC:L/AT:N/PR:N/UI:N confirms physical possession of the device is the hard prerequisite - this is not remotely exploitable. The SC:L/SI:L subsequent-system scores reflect minor impact to Quick Apps reachable through the bypass, not broader device compromise. No EPSS data is available for this CVE. The vulnerability is absent from CISA KEV, and no public proof-of-concept exists. The primary threat model is a supervised child circumventing parental controls rather than a motivated external attacker. The CVSS score of 2.4 accurately reflects the constrained attack surface. There is no data conflict: description, CVSS vector, and CWE are consistent with a local, low-impact logic bypass.

A child with unsupervised physical access to a Vivo device where Kids Mode is active navigates to the specific affected feature, triggering the flawed pop-up sequence that bypasses the password verification step. Once bypassed, the child gains access to Quick Apps that the parent had intended to restrict through the Kids Mode sandbox boundary. No public proof-of-concept exists at time of analysis.