{"id":"CVE-2026-127209","kind":"vulnerability","aliases":["CVE-2026-127209"],"related":[],"title":"Xiaomi Mi Browser: path traversal lets a co-installed app write files","description":"Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulnerability in the exported ThirdDocViewerActivity component, where CopyExternalFile.copyFromUri() copies content provider streams using an unsanitized filename from the _display_name column without basename reduction or canonical-path checks. A zero-permission co-resident malicious application can supply a crafted content provider with a _display_name containing .. sequences to make the browser write attacker-controlled bytes to an arbitrary path within its external storage directory, escaping the intended cache_docs staging location without requiring user interaction.","summary":"The Xiaomi Mi Browser Android app mishandles file names supplied by content providers, so a malicious app on the same phone can make it write files to arbitrary paths in its external storage. An attacker gets to place attacker-controlled bytes in locations the browser should not write to, without any permissions or user interaction.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","mi-browser","other","xiaomi"],"not_affected_if":["browser-not-installed","updated-browser"],"how_to_check":"- Check the installed Mi Browser version (package com.mi.globalbrowser) in Settings > Apps, and compare it with `14.66.0-gn`.","fix":"- Mi Browser (com.mi.globalbrowser): move to `14.66.0-gn` or later.","status":"open","published_at":"2026-11-12T22:19:21+00:00","first_seen_at":"2026-11-12T22:40:38+00:00","triaged_at":"2026-11-12T22:42:34+00:00","updated_at":"2026-11-12T22:42:34+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-12T22:42:34Z","model":"claude-haiku-5-5","output":{"fix":"- Mi Browser (com.mi.globalbrowser): move to `14.66.0-gn` or later.","reach":"local","title":"Xiaomi Mi Browser: path traversal lets a co-installed app write files","impact":"medium","summary":"The Xiaomi Mi Browser Android app mishandles file names supplied by content providers, so a malicious app on the same phone can make it write files to arbitrary paths in its external storage. An attacker gets to place attacker-controlled bytes in locations the browser should not write to, without any permissions or user interaction.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","xiaomi","mi-browser"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Malicious co-installed app writes arbitrary files into browser storage.","analyst_note":"","how_to_check":"- Check the installed Mi Browser version (package com.mi.globalbrowser) in Settings > Apps, and compare it with `14.66.0-gn`.","plain_action":"Update Mi Browser to version 14.66.0-gn or later through the Google Play Store or the Xiaomi app store.","product_name":"","needs_analyst":false,"not_affected_if":["browser-not-installed","updated-browser"],"who_is_affected":"Android devices with Xiaomi Mi Browser (com.mi.globalbrowser) installed before 14.66.0-gn. Exposure requires a malicious app already installed on the same device, so devices without the browser or with it updated are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000759,"input_tokens":4700,"output_tokens":578,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-127209':16A,19A '-2026':15A,18A '14.66.0':89C 'android':20B,30B,85C 'app':11A,31B,42B 'applic':86C,132C 'arbitrari':53B,156C 'attack':60B,65B,151C 'attacker-control':64B,150C 'basenam':117C 'browser':3A,23B,29B,71B,84C,148C 'byte':67B,153C 'cach':166C 'canon':121C 'canonical-path':120C 'check':123C 'co':9A,129C 'co-instal':8A 'co-resid':128C 'column':115C 'com.mi.globalbrowser':87C 'compon':100C 'contain':91C,143C 'content':37B,104C,137C 'control':66B,152C 'copi':103C 'copyexternalfile.copyfromuri':102C 'craft':136C 'cve':14A,17A 'directori':162C 'display':113C,141C 'doc':167C 'escap':163C 'export':98C 'extern':57B,160C 'file':13A,33B,51B 'filenam':110C 'get':61B 'gn':90C 'instal':10A 'intend':165C 'interact':81B,173C 'let':6A 'locat':69B,169C 'make':48B,146C 'malici':41B,131C 'mi':2A,22B,28B,83C 'mi-brows':21B 'mishandl':32B 'name':34B,114C,142C 'path':4A,54B,93C,122C,157C 'permiss':78B,127C 'phone':46B 'place':63B 'provid':38B,105C,138C 'reduct':118C 'requir':171C 'resid':130C 'sequenc':144C 'stage':168C 'storag':58B,161C 'stream':106C 'suppli':35B,134C 'thirddocvieweract':99C 'travers':5A,94C 'unsanit':109C 'use':107C 'user':80B,172C 'vulner':95C 'within':158C 'without':76B,116C,170C 'write':12A,50B,74B,149C 'xiaomi':1A,25B,27B,82C 'zero':126C 'zero-permiss':125C","nicknames":[],"mitigations":[],"who_affected":"Android devices with Xiaomi Mi Browser (com.mi.globalbrowser) installed before 14.66.0-gn. Exposure requires a malicious app already installed on the same device, so devices without the browser or with it updated are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Mi Browser to version 14.66.0-gn or later through the Google Play Store or the Xiaomi app store.","pkeys":[],"ptokens":[],"labels":["android","medium","mibrowser","other","xiaomi"],"campaign_type":null,"search_a":"'-127209':16A,19A '-2026':15A,18A 'app':11A 'browser':3A 'co':9A 'co-instal':8A 'cve':14A,17A 'file':13A 'instal':10A 'let':6A 'mi':2A 'path':4A 'travers':5A 'write':12A 'xiaomi':1A","search_b":"'android':20B,30B 'app':31B,42B 'arbitrari':53B 'attack':60B,65B 'attacker-control':64B 'browser':23B,29B,71B 'byte':67B 'content':37B 'control':66B 'extern':57B 'file':33B,51B 'get':61B 'interact':81B 'locat':69B 'make':48B 'malici':41B 'mi':22B,28B 'mi-brows':21B 'mishandl':32B 'name':34B 'path':54B 'permiss':78B 'phone':46B 'place':63B 'provid':38B 'storag':58B 'suppli':35B 'user':80B 'without':76B 'write':50B,74B 'xiaomi':25B,27B","search_c":"'14.66.0':89C 'android':85C 'applic':86C,132C 'arbitrari':156C 'attack':151C 'attacker-control':150C 'basenam':117C 'browser':84C,148C 'byte':153C 'cach':166C 'canon':121C 'canonical-path':120C 'check':123C 'co':129C 'co-resid':128C 'column':115C 'com.mi.globalbrowser':87C 'compon':100C 'contain':91C,143C 'content':104C,137C 'control':152C 'copi':103C 'copyexternalfile.copyfromuri':102C 'craft':136C 'directori':162C 'display':113C,141C 'doc':167C 'escap':163C 'export':98C 'extern':160C 'filenam':110C 'gn':90C 'intend':165C 'interact':173C 'locat':169C 'make':146C 'malici':131C 'mi':83C 'name':114C,142C 'path':93C,122C,157C 'permiss':127C 'provid':105C,138C 'reduct':118C 'requir':171C 'resid':130C 'sequenc':144C 'stage':168C 'storag':161C 'stream':106C 'suppli':134C 'thirddocvieweract':99C 'travers':94C 'unsanit':109C 'use':107C 'user':172C 'vulner':95C 'within':158C 'without':116C,170C 'write':149C 'xiaomi':82C 'zero':126C 'zero-permiss':125C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T22:19:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127209","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127209","severity":null,"published_at":"2026-11-12T22:19:21+00:00","modified_at":"2026-11-12T22:19:21+00:00","first_seen_at":"2026-11-12T22:40:38+00:00","fetched_at":"2026-11-12T22:40:38+00:00","note":null}],"documents":[{"id":139825,"url":"https://www.vulncheck.com/advisories/xiaomi-mi-browser-path-traversal-via-thirddocvieweractivity","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}