HarmonyOS EUVD-2026-60070

Exploitation requires local access to the target HarmonyOS 6.1.0 device, achieved either through a malicious application installed by the user or through direct physical device access. The vulnerability is specific to the notification service module and is relevant only when that service is active and processing notifications from other installed applications. The CVSS PR:N metric indicates no special application-level privileges are required beyond standard local execution context - a conventional unprivileged app could potentially invoke the flawed API path. Exploitation is strictly bounded to confidentiality loss; no integrity modification or denial-of-service pathway exists through this vector. The local attack vector (AV:L) is the principal limiting factor, definitively ruling out remote unauthenticated exploitation over a network.

The CVSS 3.1 score of 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a locally exploitable flaw that requires no authentication and no user interaction, with high confidentiality impact but no integrity or availability consequences. The local attack vector is the primary risk moderator: exploitation requires an attacker or malicious application to already be running on the target device, which substantially limits opportunistic mass exploitation. No EPSS data is available in the provided intelligence, the vulnerability is absent from CISA KEV, and no POC code has been identified - all signals consistent with limited or no observed active exploitation. Despite the medium CVSS band, organizations managing large Huawei device fleets - even a mid-sized municipal IT department in gdynia deploying HarmonyOS devices across city services - should prioritize patching given the sensitivity of content transiting the notification layer. The absence of I and A impact metrics is consistent with a read-only disclosure path; no data manipulation or denial-of-service vector is indicated by the available data.

A malicious application installed on a HarmonyOS 6.1.0 device invokes the notification service API without holding the required permission, successfully bypassing the access control check and reading notification content from other applications - such as one-time passwords from banking apps or message previews from messaging services. No public POC code has been identified, but the low attack complexity (AC:L) and absence of required privileges (PR:N) suggest the flaw is reproducible by a developer familiar with the HarmonyOS notification API.