CVE-2026-123993

Summary

A QA build of the Google Cobalt browser engine in Hisense VIDAA Smart TV firmware exposes an unauthenticated WebDriver server on TCP port 4444, allowing LAN-adjacent attackers to execute arbitrary JavaScript and access sensitive data and system functions via the exposed automation interface.

Exploitability

Exploitation requires only network access to the TV on the same LAN segment, no authentication or user interaction, and is trivial for an attacker with basic scripting skills.

Blast radius

Successful exploitation enables full compromise of user privacy (telemetry, credentials, location), persistent display manipulation, and low-level system control including filesystem read/write via the native bridge.

Detection

Defenders should monitor for outbound connections from TV devices to internal network IPs on TCP port 4444, or inbound connections to port 4444 from non-authorized hosts on the same subnet; no standard log entries are generated by the vulnerable service itself.

Prioritized remediation

Upgrade to firmware version V0000.01.00a.P0221 or later, which disables the WebDriver server in production builds; if unavailable, disable the WebDriver service by blocking TCP port 4444 at the network perimeter and disabling QA build features via firmware configuration.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.