HarmonyOS EUVD-2026-74616

Physical access to the target device is required (AV:P) - remote exploitation is impossible. The attack requires high complexity (AC:H), meaning specific device state, configuration, or interaction sequence must be satisfied. User interaction (UI:R) is mandatory, implying either the attacker must manipulate the device owner into performing an action or must perform specific UI gestures themselves during the physical access window. The scope change (S:C) only produces confidential data exposure; no integrity or availability impact applies. Exploitation is further limited to HarmonyOS 4.0.0-4.3.3 and EMUI 14.0.0-16.0.0; devices running patched firmware from the September 2026 bulletin are not affected.

Real-world risk is moderate-to-low despite the C:H confidentiality sub-score. The CVSS base score of 4.8 reflects the significant exploitation barriers: physical device access (AV:P), high attack complexity (AC:H), and mandatory user interaction (UI:R). These collectively make opportunistic or remote exploitation infeasible. No EPSS data was provided; given AV:P and AC:H, automated exploitation at scale is not realistic. No public POC exists and the vulnerability is not listed in CISA KEV, confirming no confirmed active exploitation. The 'Privilege Escalation' tag may slightly overstate the nature of the impact - the CVSS indicates confidentiality-only impact (C:H, I:N, A:N) with no privilege gain that grants persistent elevated access, suggesting 'Information Disclosure' might be more precisely accurate, though the permission control bypass mechanism is consistent with an escalation framing. The CVSS 4.8 score is well-calibrated for this physical-access, high-complexity scenario.

An attacker with brief unsupervised physical access to an unlocked or partially-locked HarmonyOS device navigates to the Settings module and, through a specific sequence of interactions (UI:R), triggers the permission control flaw to access confidential data belonging to a separate system component - such as protected account credentials, system configuration data, or sensitive user information. The high attack complexity (AC:H) implies specific preconditions, timing, or device state are required, making casual exploitation unlikely. No public exploit code is available at time of analysis.