HarmonyOS CVE-2026-49308

Exploitation requires local access to the device - an attacker must have a malicious application executing on the target HarmonyOS 6.1.0 device. User interaction is required: the victim must perform a copy action (placing data into the clipboard) for sensitive data to be accessible. The CVSS PR:N indicates no prior system privileges are required for the exploiting process itself, but the app must be installed on the device. Limiting factors include: (1) local-only attack vector eliminates remote exploitation; (2) user must actively copy data during the attack window; (3) only confidentiality is affected - no integrity or availability impact. The vulnerability does not affect default idle-state devices and cannot be triggered without a clipboard write event initiated by the user.

The CVSS 5.5 Medium score reflects a constrained threat profile: local access is required (AV:L), no prior privileges are needed (PR:N), but user interaction must occur (UI:R), and scope is unchanged (S:U) with only confidentiality impact (C:H/I:N/A:N). SSVC independently corroborates a lower urgency posture - exploitation is rated 'none', the attack is not automatable, and technical impact is only 'partial'. EPSS data was not supplied, but the combination of local-only vector and SSVC 'none' exploitation status suggests very low probability of opportunistic exploitation in the near term. The C:H rating is the most significant signal: clipboard data on a mobile device can contain passwords, authentication tokens, or sensitive personal information, making the confidentiality impact non-trivial even if reach is limited. No public exploit code has been identified, and CISA has not added this to the KEV catalog. Overall, this is a genuine but bounded risk - meaningful for high-assurance mobile deployments or environments handling sensitive data, but not an emergency priority for most organizations.

A malicious application installed on a HarmonyOS 6.1.0 device waits for the user to copy sensitive data - such as a password or authentication token - to the clipboard. Due to the permission control flaw in the clipboard module, the malicious app reads the clipboard contents without holding the required permissions, exfiltrating the data to an attacker-controlled server. No public exploit code for this specific vulnerability has been identified at time of analysis.