CVE-2026-127209: Xiaomi Mi Browser < 14.66.0 Path Traversal via ThirdDocViewerActivity
Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulnerability in the exported ThirdDocViewerActivity component, where CopyExternalFile.copyFromUri() copies content provider streams using an unsanitized filename from the displayname column without basename reduction or canonical-path checks. A zero-permission co-resident malicious application can supply a crafted content provider with a displayname containing .. sequences to make the browser write attacker-controlled bytes to an arbitrary path within its external storage directory, escaping the intended cachedocs staging location without requiring user interaction.
Event History
Frequently Asked Questions
Who can exploit this issue?
A malicious application installed on the same Android device can exploit it without requesting permissions or requiring user interaction. The vulnerable component is exported, allowing another local app to invoke it.
What access does an attacker need?
The attacker needs to be able to install and run a co-resident Android application on the target device. They can provide a crafted content provider whose _display_name includes .. path sequences.
What can a successful exploit do?
It can cause Mi Browser to write attacker-controlled bytes to an arbitrary path within Mi Browser's external storage directory. This escapes the intended cache_docs staging directory, but the provided data does not indicate impact outside that external storage area.
How can I determine whether my installation is affected?
Mi Browser package com.mi.globalbrowser is affected if its version is earlier than 14.66.0-gn. The issue is specifically associated with the exported ThirdDocViewerActivity component.