HarmonyOS CVE-2026-41962

Exploitation requires local code execution context on the HarmonyOS device (the attacker or malicious code must already have local access or be installed as an app). User interaction is mandatory-the vulnerable code path is triggered only when a user participates in app installation or permission management (UI:R). No network access is possible; the attack is strictly local. The vulnerability affects all HarmonyOS versions, suggesting it is not configuration-dependent, but no documentation confirms whether it affects all execution contexts (user profiles, guest mode, enterprise deployments) or only specific ones. Authentication is not required in the traditional sense because local code already executes with some privilege level; the flaw allows escalation beyond that baseline.

This vulnerability presents LOW real-world risk despite privilege escalation classification. The CVSS 3.6 score is accurate: local attack vector eliminates remote threats, and the requirement for user interaction (UI:R) significantly reduces automatable exploitation. EPSS data is unavailable, but the low CVSS combined with local-only access and user interaction prerequisites suggests exploitation probability is limited to scenarios where an attacker has already obtained local system access or can socially engineer a user. The confidentiality-only impact (C:L, no integrity or availability changes) further constrains real-world harm. However, in multi-user or containerized HarmonyOS deployments (e.g., work profiles, sandboxed apps), this privilege escalation could escalate intra-system access. KEV status is unknown-no public exploitation data available. The vulnerability is unlikely to be prioritized above critical/high-CVSS issues in most threat models, but should be remediated in environments where local privilege escalation is a concern.

A malicious third-party app (or compromised legitimate app) requests installation with standard permissions. During or after installation, it exploits the permission control bypass to escalate privileges and access confidential service data (e.g., system credentials, user data) that should be restricted. The attack requires the user to complete the installation interaction (e.g., confirm a permission prompt), making it dependent on user action rather than purely automated.