What is the CVSS score of CVE-2026-18907?

CVE-2026-18907 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Hi Browser are affected by CVE-2026-18907?

TECNO Hi Browser for Android (version 2.23.1.1) is susceptible to arbitrary file writes through path traversal in download filenames, potentially allowing attackers to corrupt or overwrite critical…

How to fix or mitigate CVE-2026-18907?

Within 24 hours, identify all Android devices in your organization running TECNO Hi Browser 2.23.1.1 and document their business function. Within 7 days, communicate to affected users that TECNO Hi Browser should not be used for downloading files from untrusted sources and direct them to use alternative browsers (Chrome, Firefox, Edge) until a patch is available. Within 30 days, monitor TECNO's security advisory channels for patch release notification and establish a deployment process to update devices within 72 hours of patch availability; implement a mobile device management (MDM) policy requiring browser updates within 14 days of release to prevent similar exposure in the future.

Hi Browser CVE-2026-18907

EUVD-2026-53021 HIGH

Relative Path Traversal (CWE-23)

2026-08-05 TECNOMobile

GHSA-r4f5-m256-cxv8

Path Traversal Google Hi Browser Tecno Mobile

7.5

CVSS 3.1 · Vendor: TECNOMobile

Severity by source

Vendor (TECNOMobile) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Arbitrary file write maps to I:H not A:H; user must trigger a download action, so UI:R; no confidentiality impact described.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TECNOMobile).

CVSS VectorVendor: TECNOMobile

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:55 vuln.today

CVSS changed

Aug 06, 2026 - 15:22 NVD

7.5 (HIGH)

CVE Published

Aug 05, 2026 - 01:47 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 05, 2026 - 01:47 cve.org

HIGH 7.5

DescriptionCVE.org

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename.

AnalysisAI

Arbitrary file write via path traversal in TECNO Mobile's Hi Browser 2.23.1.1 on Android exposes device filesystems to attacker-controlled writes when a user downloads a crafted file with traversal sequences in its filename. Any server delivering a download with a malicious Content-Disposition filename can redirect the saved file outside the intended download directory, potentially overwriting application data or configuration files on the device. No confirmed active exploitation (not in CISA KEV) and an EPSS score of 0.24% (15th percentile) indicate low real-world exploitation probability despite the high CVSS base score.

Technical ContextAI

Hi Browser (Android package com.talpa.hibrowser) is the default browser bundled on TECNO Mobile Android devices. The root cause is CWE-23 (Relative Path Traversal): the browser's download feature consumes an attacker-supplied filename - likely sourced from the HTTP Content-Disposition header or a crafted URL - without sanitizing directory traversal sequences such as '../' before constructing the target filesystem path. This allows writes to be redirected outside the browser's designated download directory. The CPE cpe:2.3:a:tecno_mobile:hi_browser:*:*:*:*:*:*:*:* uses a wildcard version, though EUVD and TECNO SRC both pin the confirmed affected release to 2.23.1.1. On Android, the actual overwrite scope is bounded by the browser process's UID sandbox, but within that boundary arbitrary path write can manipulate shared storage and application-accessible directories.

RemediationAI

Consult the TECNO Mobile Security Response Center advisory at https://security.tecno.com/SRC/securityUpdates for the patched Hi Browser release; no specific fix version number has been independently confirmed from the available references, so the advisory page must be checked directly for update availability. On TECNO Android devices, Hi Browser updates are typically delivered via OTA system update or through TECNO's application store. As an interim compensating control, users should avoid initiating file downloads from untrusted or unknown websites through Hi Browser, as the attack requires a server-supplied malicious filename. Switching to an alternate browser (e.g., Chrome or Firefox) for file download workflows entirely sidesteps this vulnerability with no side effects until a patched Hi Browser version is confirmed and deployed.