HarmonyOS CVE-2026-49312

Exploitation requires local code execution on a HarmonyOS 6.1.0 device - the CVSS AV:L metric confirms no remote exploitation path exists. AC:H indicates a specific window state, race condition, or system condition must be triggered; exploitation is not a straightforward single-request operation. PR:N means no elevated device privileges are required beyond having a locally-executing process. UI:N indicates no additional user interaction is required once local execution is established. Impact is limited to confidentiality (C:L) and possibly minor service availability (A:L per vendor CVSS); there is no integrity impact. Exploitation is further bounded to devices running HarmonyOS 6.1.0 specifically - other versions are not confirmed affected.

Real-world risk is low to moderate. The CVSS base score of 4.0 reflects a constrained threat profile: AV:L requires the attacker to already have a local foothold (installed app or prior compromise), and AC:H indicates a specific system state or timing condition must be met - exploitation is not reliable or trivially repeatable. Impact is bounded to limited confidentiality loss (C:L) and minor availability disruption (A:L); integrity is unaffected. There is no CISA KEV listing, no known public proof-of-concept, and no EPSS data available in the provided input. One notable inconsistency: the vendor description mentions only confidentiality impact, yet the CVSS vector includes A:L (availability low) - defenders should verify with Huawei's bulletin whether a secondary denial-of-service condition exists or whether this is a scoring artifact. The 'Privilege Escalation' tag loosely maps to CWE-264 but the described outcome is information disclosure rather than privilege gain; this tag should be interpreted cautiously and not used to elevate the risk tier.

A malicious application installed on a HarmonyOS 6.1.0 device invokes window module APIs without the expected permission enforcement, exploiting a specific timing or state condition (consistent with AC:H) to read data belonging to a protected service. The attacker extracts limited confidential data - such as service state or displayed content - that should be inaccessible to the app's permission level. No public proof-of-concept has been identified, and the high complexity requirement makes reliable exploitation non-trivial.