---
id: "CVE-2026-127209"
page: "https://infrastack.ai/live/CVE-2026-127209"
kind: "vulnerability"
aliases: ["CVE-2026-127209"]
title: "Xiaomi Mi Browser: path traversal lets a co-installed app write files"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "mi-browser", "other", "xiaomi"]
not_affected_if: ["browser-not-installed", "updated-browser"]
published_at: "2026-11-12T22:19:21+00:00"
first_seen_at: "2026-11-12T22:40:38+00:00"
updated_at: "2026-11-12T22:42:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127209", "first_seen_at": "2026-11-12T22:40:38+00:00"}]
exploit_sources: []
---

# Xiaomi Mi Browser: path traversal lets a co-installed app write files

Link for people: https://infrastack.ai/live/CVE-2026-127209 (this .md is for agents)

The Xiaomi Mi Browser Android app mishandles file names supplied by content providers, so a malicious app on the same phone can make it write files to arbitrary paths in its external storage. An attacker gets to place attacker-controlled bytes in locations the browser should not write to, without any permissions or user interaction.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Mi Browser version (package com.mi.globalbrowser) in Settings > Apps, and compare it with `14.66.0-gn`.

## Fix

- Mi Browser (com.mi.globalbrowser): move to `14.66.0-gn` or later.

## Timeline

- 2026-11-12T22:40:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127209

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/xiaomi-mi-browser-path-traversal-via-thirddocvieweractivity

## From the sources

Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulnerability in the exported ThirdDocViewerActivity component, where CopyExternalFile.copyFromUri() copies content provider streams using an unsanitized filename from the _display_name column without basename reduction or canonical-path checks. A zero-permission co-resident malicious application can supply a crafted content provider with a _display_name containing .. sequences to make the browser write attacker-controlled bytes to an arbitrary path within its external storage directory, escaping the intended cache_docs staging location without requiring user interaction.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_