Lenovo Application CVE-2026-7516

The vulnerability requires the user to actively visit a malicious website using the specific Lenovo-built browser application on the affected device (UI:A per CVSS 4.0). The device must be a Lenovo Android tablet sold in the Chinese market with the affected Lenovo Application installed. No attacker authentication is required (PR:N), and the attack initiates over the network (AV:N). Limiting factors include: (1) geographic and hardware scope - only Chinese-market Lenovo tablets are affected, not Lenovo devices sold globally; (2) active user interaction - the user must navigate to an attacker-controlled or attacker-compromised page using the specific built-in browser, not any other browser installed on the device; (3) the attack yields only clipboard write access (VI:L) with no direct code execution or data exfiltration path. Exploitation is not automatable without user-initiated browsing.

The CVSS 4.0 base score of 5.1 (Medium) reflects the limited impact: only clipboard integrity is affected (VI:L), with no confidentiality, availability, or subsequent-system impact. The attack vector is network (AV:N) with low complexity (AC:L) and no authentication required (PR:N), which might suggest broad exposure, but the UI:A requirement (active user interaction - visiting the malicious site) meaningfully reduces automated exploitation potential. Real-world risk is further bounded by the narrow deployment scope: only Lenovo Android tablets sold in the Chinese market are affected, limiting the total addressable attack surface significantly. No EPSS score was available in provided intelligence, and the vulnerability is not listed in CISA KEV, meaning no confirmed active exploitation. No public proof-of-concept code was referenced. The primary realistic harm is clipboard hijacking enabling secondary fraud - particularly cryptocurrency address substitution or credential/URL replacement - which, while impactful per-victim, is not a high-severity systemic risk. This is a low-urgency but valid patching target for affected device owners.

An attacker publishes a malicious webpage containing JavaScript or a browser interface call that invokes the exposed clipboard-write method in Lenovo's built-in browser. When a user on an affected Chinese-market Lenovo tablet visits this page using the built-in browser, the page silently replaces the clipboard contents - for example, substituting a legitimate cryptocurrency wallet address the user had just copied with one controlled by the attacker. The user then pastes the manipulated address into a transaction, resulting in funds being sent to the attacker. No public proof-of-concept code has been identified, but the low attack complexity (AC:L) suggests the technique is straightforward to implement for any web developer.