Emui CVE-2026-28553

CVSS 6.9 with vector AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L presents moderate-to-high risk grounded in realistic exploitation constraints. The local attack vector (AV:L) significantly reduces exposure compared to network vectors, but the scope change (S:C) indicates the impact crosses privilege or security domain boundaries-critical for confidentiality breaches. High complexity (AC:H) and mandatory user interaction (UI:R) further limit practical exploitation, though not to negligible levels; these factors require an attacker to craft specific conditions or social-engineer user action. The high confidentiality impact (C:H) against lower integrity (I:L) and availability (A:L) marks this as a clear information-disclosure vector. No EPSS, KEV status, or POC confirmation provided in input; absent active exploitation signals, this is a real but not imminent priority for enterprise/consumer deployments. Organizations with sensitive local data or strict data-isolation requirements should prioritize patching after verifying affected versions in their environment.

An attacker with local access to a HarmonyOS or EMUI device could launch the theme settings application, craft or trigger specific interactions with theme configuration dialogs, and exploit the permission validation gap to read sensitive information normally restricted by user permission boundaries-such as private app data, system configuration, or user preferences. The requirement for local access and user interaction (e.g., opening the theme settings app) limits the attack to scenarios where the attacker has physical device access or the ability to trick a user into opening a malicious theme file or settings prompt.