peter bassill · operator
$ cve CVE-2018-20523 JSON

CVE-2018-20523 EXPLOIT

5.3
MEDIUM · CVSS 3.1 · EPSS 10% (pctl 95)

Patch early

A public exploit exists.

Description

Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection. In other words, a third-party application can read the user's cleartext browser history via an app.provider.query content://com.android.browser.searchhistory/searchhistory request.

Scoring

CVSS5.3 (MEDIUM, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS10.01% — more likely to be exploited than 95% of all CVEs
WeaknessCWE-77
On CISA KEVno
Public exploityes
Published2019-06-07
Last modified2026-06-17

Affected (37)

VendorProduct
miredmi 4a
miredmi 4a firmware
miredmi 5 plus
miredmi 5 plus firmware
miredmi 6
miredmi 6 firmware
miredmi 6a
miredmi 6a firmware
miredmi 7
miredmi 7 firmware
miredmi 7a
miredmi 7a firmware
miredmi go
miredmi go firmware
miredmi k20
miredmi k20 firmware
miredmi k20 pro
miredmi k20 pro firmware
miredmi note 4
miredmi note 4 firmware
miredmi note 5
miredmi note 5 firmware
miredmi note 5 pro
miredmi note 5 pro firmware
miredmi note 5a prime
miredmi note 5a prime firmware
miredmi note 6 pro
miredmi note 6 pro firmware
miredmi note 7
miredmi note 7 firmware
miredmi note 7s
miredmi note 7s firmware
miredmi s2
miredmi s2 firmware
miredmi y3
miredmi y3 firmware
mistock browser

Public exploits

SourceTitleDate
exploit-dbXiaomi browser 10.2.4.g - Browser Search History Disclosure2021-08-10

References

→ the Explorer  ·  watch your stack  ·  NVD