CVE-2026-123993: Hisense VIDAA Smart TV Unauthenticated WebDriver Remote Access
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability where a QA build of the Google Cobalt browser engine exposes the WebDriver automation server on TCP port 4444 across all network interfaces without any authentication or pairing requirement. A LAN-adjacent attacker can connect to the exposed WebDriver service to execute arbitrary JavaScript, read and exfiltrate sensitive localStorage data including ACR telemetry, MAC addresses, ad-service credentials, and location data, inject persistent content onto the display, and access the window.hisense native bridge to perform filesystem read/write and system-state operations.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Hisense VIDAA Smart TVs running firmware V0000.01.00a.P0220 are affected. The WebDriver server listens on TCP port 4444 on all network interfaces, so devices reachable by an attacker on the local network are exposed.
Does exploitation require authentication, pairing, or user interaction?
No. The exposed WebDriver automation server has no authentication or pairing requirement, allowing a LAN-adjacent attacker to connect directly to it.
What could an attacker do after connecting to the service?
An attacker can execute arbitrary JavaScript, extract localStorage data such as ACR telemetry, MAC addresses, ad-service credentials, and location data, and inject persistent display content. Access to the window.hisense native bridge may also allow filesystem read/write and system-state operations.
How can I determine whether a TV is potentially affected?
Verify whether the device runs firmware V0000.01.00a.P0220 and whether TCP port 4444 is reachable on the TV from the local network. A reachable WebDriver service on that port indicates the exposed attack surface described here.