CVE-2026-18907

Summary

The flaw allows arbitrary file write through directory traversal sequences in the filename, enabling potential data corruption or malicious code execution on affected Android devices.

Exploitability

Exploitation requires control over the filename input and knowledge of the target device's file structure; it is moderately difficult to exploit without these details.

Blast radius

If exploited, this could lead to significant data loss or unauthorized modifications on the user’s device, impacting privacy and system integrity.

Prioritized remediation

Update to a patched version of com.talpa.hibrowser if available, or uninstall the application entirely.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.