Honor E CVE-2026-31370

Successful exploitation requires user interaction (UI:R) - an attacker cannot trigger the information disclosure unilaterally but must socially engineer or convince a target user to interact with the vulnerable Honor E App feature (e.g., click a link, submit a form, or visit a crafted URI). The vulnerability is exploitable over the network (AV:N) against default configurations (AC:L/PR:N), meaning no authentication or privilege escalation is required once the user interaction occurs. The specific vulnerable endpoint(s), data exposure mechanism (URL parameters, response headers, client-side storage), and exact user action required are not detailed in the available advisory - verify with Honor's full technical advisory for precise exploitation prerequisites.

CVSS 6.3 with AV:N/AC:L/PR:N/UI:R reflects moderate real-world risk moderated by user interaction requirement. The network attack vector and low complexity indicate the vulnerability is trivially accessible once triggered, but the UI:R constraint significantly limits automated mass exploitation - an attacker cannot trigger the leak without social engineering or user-initiated action (e.g., clicking a link, submitting a form). No EPSS score, CISA KEV listing, or public exploit code is referenced, suggesting either limited visibility in threat intelligence feeds or controlled/narrow exploitation scope. The absence of severity classification (I:L/A:L alongside C:L) indicates limited impact on confidentiality alone, with minimal integrity and availability implications. This profile suggests a real but not critical priority - suitable for standard patch cycles rather than emergency response, unless Honor's customer base and data sensitivity warrant elevated treatment. The primary risk is gradual credential or session token disclosure rather than active worm-like propagation.

An attacker crafts a malicious link or message directing a target user to interact with a Honor E App feature that inadvertently exposes sensitive information (e.g., personal data, session tokens, or configuration details) in HTTP responses or cached client-side storage. The user clicks the link or performs the requested action, triggering the data leak without realizing confidential information is now exposed to the attacker via network interception or shared device access. The leaked data could be leveraged for account takeover, identity theft, or lateral movement within Honor's ecosystem.