CVE-2026-127209

Received Received - Intake

Path Traversal in Xiaomi Mi Browser Android App

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: VulnCheck

Description

Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulnerability in the exported ThirdDocViewerActivity component, where CopyExternalFile.copyFromUri() copies content provider streams using an unsanitized filename from the _display_name column without basename reduction or canonical-path checks. A zero-permission co-resident malicious application can supply a crafted content provider with a _display_name containing .. sequences to make the browser write attacker-controlled bytes to an arbitrary path within its external storage directory, escaping the intended cache_docs staging location without requiring user interaction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-12

Last Modified

2026-11-12

Generated

2026-11-13

AI Q&A

2026-11-13

EPSS Evaluated

N/A

NVD

CVE-2026-127209

EUVD

EUVD-2026-124719

Affected Vendors & Products

Vendor	Product	Version / Range
Xiaomi	Mi Browser (com.mi.globalbrowser)	From 0 (inc) to 14.66.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Xiaomi Mi Browser before version 14.66.0-gn has a path traversal flaw in the ThirdDocViewerActivity component. A malicious app can exploit this by providing a crafted content provider with a filename containing '..' sequences. This allows writing arbitrary files to any location within the browser's external storage directory without user interaction.

Detection Guidance

This vulnerability is specific to the Xiaomi Mi Browser Android application and requires checking the installed version. Use the command 'adb shell pm list packages -f com.mi.globalbrowser' to locate the app, then 'adb shell dumpsys package com.mi.globalbrowser | grep versionCode' to check the version. If the version is below 14.66.0-gn, the app is vulnerable.

Impact Analysis

An attacker could overwrite sensitive files in the browser's storage, potentially stealing data or executing malicious code. Since it requires a co-resident app, physical access or prior compromise is needed. User data or app integrity may be at risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity/confidentiality principles or HIPAA's safeguards for protected health information. Compliance may be compromised if user data is exposed or altered.

Mitigation Strategies

Update the Xiaomi Mi Browser app to version 14.66.0-gn or later. If an update is not available, uninstall the app until a patch is released. Avoid installing untrusted apps that could exploit this vulnerability.

Hi! I’m here to help you understand CVE-2026-127209. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...