EUVD-2026-66296
GHSA-9jjv-9v55-qm2c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain physical device access
-
DeliveryNavigate into Kids Mode
-
ExploitOpen the affected built-in webpage
-
ExecutionControl logic defect renders gallery photos
-
ImpactView restricted local photos
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Component isolation
|
| Exploitation Conditions | Physical access to the device is required (CVSS AV:P) - this is the primary and most significant limiting condition. The device must be actively running Vivo Kids Mode with the specific affected built-in webpage accessible. The vulnerability is scoped exclusively to the Kids Mode environment; standard device operation outside of Kids Mode is not affected. Within the Kids Mode context, no credentials or authentication are required (PR:N in the provided vector), but the physical access prerequisite substantially restricts who can exploit it. The identity of the specific built-in webpage that triggers the defect is not disclosed in available data. |
| Impact | The CVSS 4.0 score of 2.4 accurately reflects the extremely narrow real-world risk profile: physical access (AV:P) is mandatory, which substantially limits the attacker population to individuals with direct, hands-on device access. The impact is confined to limited confidentiality exposure of gallery photos with no availability impact. No EPSS data was provided, but the physical access requirement alone effectively eliminates remote or mass exploitation scenarios. No CISA KEV listing and no public exploit code exist at time of analysis. Notably, the provided CVSS 4.0 vector includes VI:L (integrity impact) and SC:L (subsequent-system confidentiality impact), which are not clearly supported by a read-only gallery disclosure - these ratings appear to reflect vendor conservatism rather than documented impact. Overall, this is genuinely low priority: a parental-control sandbox bypass requiring hands-on device access, not an operational emergency for enterprise security teams. |
| Exploit ScenarioDerived | An individual with physical access to a Vivo device actively running Kids Mode navigates to the specific affected built-in webpage, which due to the control logic defect renders local gallery photos within the page context. The person can thereby view photos that the Kids Mode sandbox is designed to restrict from the child-user session. No public exploit code exists at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Kids Mode on Vivo devices exposes local gallery photos through a control logic defect in a specific built-in webpage, bypassing the sandboxed environment's access restrictions. All versions of Vivo Kids Mode are affected per the wildcard CPE (cpe:2.3:a:vivo:kids_mode:*:*:*:*:*:*:*:*). Exploitation requires physical access to the device; no public exploit code and no CISA KEV listing exist at time of analysis.
RemediationAI
Consult the Vivo security advisory at https://www.vivo.com/en/support/security-advisory-detail?id=24 for official patch or firmware update guidance. No specific fixed version number is identified in the available data; patch status is unconfirmed beyond the advisory reference itself. As a compensating control, device owners can disable or avoid activating the Kids Mode feature until a patch is confirmed applied - this removes the vulnerable attack surface but also removes parental control functionality. Restricting physical access to the device when Kids Mode is active also eliminates the exploitation prerequisite.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Vivo Kids Mode is a restricted operating environment designed to limit children's access to sensitive device content, applications, and system features. The root cause is classified as CWE-653 (Insufficient Separation of Privileged Code), indicating that the access boundary between the Kids Mode sandbox and the device's general storage is insufficiently enforced at the control-logic level. A built-in webpage within the Kids Mode interface contains a defect that causes local gallery photos to be rendered directly within the page, circumventing the intended content restrictions. The affected product scope covers all versions of Vivo Kids Mode per CPE cpe:2.3:a:vivo:kids_mode:*:*:*:*:*:*:*:*, as self-reported by Vivo.
Know when Kids Mode gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N
Physical access required; no authentication needed within Kids Mode; limited confidentiality impact from gallery exposure; no integrity or availability impact supported by description.
Primary rating from Vendor (Vivo).
CVSS VectorVendor: Vivo
DescriptionCVE.org
A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB