HarmonyOS CVE-2026-49307

Local device access is required - the CVSS vector specifies AV:L, confirming this is not remotely exploitable. The vulnerability resides specifically in the multi-mode input module, so that module must be active or accessible on the target device; HarmonyOS 6.1.0 is the confirmed affected version. PR:N indicates that no special system privileges are needed, meaning a zero-permission local application or interactive local session is sufficient to trigger the flaw. UI:N confirms no victim interaction is required after the attacker gains local presence. Limiting factors: physical or logical local access to the device is mandatory; remote network-based exploitation is not possible based on the CVSS AV:L metric; exploitation is bounded to confidentiality impact only (I:N, A:N), so data exfiltration is the realistic outcome rather than device takeover or denial of service.

The CVSS 6.2 medium score reflects a local-only attack surface (AV:L), which substantially constrains real-world exploitability compared to network-exposed vulnerabilities. However, the combination of AC:L, PR:N, and UI:N means that once an attacker has local device access - such as through a sideloaded malicious app - exploitation requires no special privileges and no user interaction, making it a reliable primitive for a staged attack chain. The C:H rating indicates meaningful confidentiality impact. No EPSS score was provided in the input data, so exploitation probability cannot be quantified here. KEV status is negative and no POC has been identified, suggesting this is not currently being weaponized at scale. Real-world risk is moderate: defenders on managed device fleets should prioritize patching, but the local prerequisite meaningfully limits opportunistic exploitation compared to remote vulnerabilities of equivalent CVSS score.

A malicious application installed on a HarmonyOS 6.1.0 device exploits the permission control gap in the multi-mode input module to read sensitive data - such as keystrokes, clipboard content, or session tokens - belonging to other processes without requiring elevated privileges. No public proof-of-concept has been identified, but the low attack complexity (AC:L) and absence of privilege requirements (PR:N) suggest that a functional exploit would be straightforward to develop for a motivated actor with local access.