EUVD-2026-66295
GHSA-7m73-xqjh-9675
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical access mandatory (AV:P); no privileges needed (PR:N); scope unchanged as impact is confined to Kids Mode sandbox and Quick Apps (S:U); no availability impact.
Primary rating from Vendor (Vivo).
CVSS VectorVendor: Vivo
Lifecycle Timeline
1DescriptionCVE.org
A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app.
AnalysisAI
Kids Mode on Vivo Android devices contains a pop-up logic flaw that permits physical-access bypass of the parental password gate, enabling a child or any person holding the device to launch Quick Apps outside the Kids Mode sandbox. The CVSS 4.0 score of 2.4 reflects the mandatory physical access requirement and limited low-level confidentiality and integrity impact on both the device and downstream mini-app systems. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Physical possession of the Vivo device is required (AV:P) - remote exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is low in any organizational or enterprise context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Vivo security advisory at https://www.vivo.com/en/support/security-advisory-detail?id=25 for official patch details. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today