HarmonyOS EMUI CVE-2026-49303

Exploitation requires that the attacker's code is already executing locally on the target device - for example, as an installed application running in the standard app sandbox. The vulnerability is in the notification module specifically; devices where HarmonyOS or EMUI versions 4.0.0-4.3.1 or EMUI 14.0.0-15.0.0 are running are in scope. No special configuration or non-default setting is required beyond having a vulnerable OS version. What limits exploitation is the local-only attack vector: remote unauthenticated exploitation is not possible - an attacker must have a means of executing code on-device, such as convincing the user to install a malicious application. Additionally, the impact ceiling is integrity and availability at the Low level, with no confidentiality impact, which bounds the damage achievable even by a successful exploit.

The CVSS 5.1 base score with vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L reflects a moderate local privilege escalation with no confidentiality impact. The local attack vector meaningfully constrains exposure - an attacker must already have code execution on the target device, whether via a malicious app or physical access. The PR:N rating indicates no elevated privileges are required to trigger the flaw, which is consistent with the mobile app sandbox context where many apps run as unprivileged processes. No EPSS score was provided in the available data; without it, probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no POC is known, meaning this is a patching-cadence risk rather than an active incident response priority. The constrained impact (I:L/A:L, no C impact) further reduces urgency compared to full remote code execution or confidentiality-exposing flaws. Overall, this is a real but lower-priority issue for enterprise security teams; consumer device owners should patch through normal Huawei update channels.

A malicious Android or HarmonyOS application installed on a victim's device - potentially disguised as a utility or game - invokes notification module APIs without holding the required permissions, exploiting the missing permission check to suppress, modify, or flood the device's notification queue. This degrades notification reliability for legitimate apps and may allow minor manipulation of notification content, though no credential theft or data exfiltration is enabled by this flaw alone. No public proof-of-concept code has been identified at time of analysis.