Introduction
An out-of-bounds write in OpenHarmony's web_webview component lets a remote attacker execute arbitrary code inside pre-installed applications. The attacker needs only low privileges, and no user interaction is required. The vulnerability carries a CVSS 3.1 score of 8.8, and the OpenHarmony ecosystem spans more than one billion devices, so the exposure reaches well into IoT and embedded hardware.
OpenHarmony is a family of open-source distributed operating systems that originally drew on principles from the Huawei LiteOS lineage. Huawei donated the core source code to the OpenAtom Foundation, the first foundation for open-source software in China. The project now works with more than five hundred hardware partners on smartphones, tablets, smart TVs, and industrial infrastructure. With that many deployment targets, any remotely exploitable flaw in a core component is a serious concern for the wider embedded systems ecosystem.
Technical Information
Root Cause: Out-of-Bounds Write (CWE 787)
The vulnerability is in the web_webview component of OpenHarmony. The root cause is an out-of-bounds write, classified as CWE 787, in which the software writes data past the end or before the beginning of the intended buffer. The code defect is linked to a flowbuffer security issue in the chromium_src repository, tracked as issue 5602.
CVSS Vector Breakdown
The full CVSS 3.1 vector string is:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Each metric means the following:
| Metric | Value | Meaning |
|---|---|---|
| Attack Vector (AV) | Network | Exploitable remotely over the network |
| Attack Complexity (AC) | Low | No special conditions or race conditions required |
| Privileges Required (PR) | Low | Attacker needs minimal authentication |
| User Interaction (UI) | None | No victim action needed |
| Scope (S) | Unchanged | Impact stays within the vulnerable component's authority |
| Confidentiality (C) | High | Full read access to data within the app context |
| Integrity (I) | High | Full modification capability |
| Availability (A) | High | Complete denial of service possible |
Attack Flow
Based on the available information, exploitation follows this sequence:
- The attacker identifies a target device running OpenHarmony v5.0.3 through v6.0 with a pre-installed application that uses the
web_webviewcomponent. - The attacker sends specially crafted data over the network to the vulnerable application. The data is built to trigger the flowbuffer flaw in the underlying
chromium_srccode. - The crafted input causes an out-of-bounds write in the webview's buffer-handling logic, which corrupts adjacent memory.
- By controlling the data written past the buffer boundary, the attacker achieves arbitrary code execution in the context of the pre-installed application.
Network access, low complexity, and no user interaction together make this vulnerability especially concerning. An attacker does not need to trick anyone into visiting a malicious page or clicking a link. The low privilege requirement and the absence of user interaction suggest the attack can be carried out against a listening service or background component.
Flowbuffer Defect in chromium_src
The chromium_src repository describes the underlying defect as a "flowbuffer security issue." The OpenHarmony project maintains its own fork of the Chromium source code for the webview component, and the vulnerable buffer-handling logic was in that fork. Fixes went in as pull requests on three release branches: PR 7093 (v6.0), PR 7110 (v5.1.0), and PR 7108 (v5.0.3).
Affected Systems and Versions
The following OpenHarmony versions and components are confirmed affected:
| OpenHarmony Version | Component | Status | Fix Reference |
|---|---|---|---|
| v6.0 Release | web_webview | Affected | PR 7093 |
| v5.1.0 Release | web_webview | Affected | PR 7110 |
| v5.0.3 Release | web_webview | Affected | PR 7108 |
Any device running OpenHarmony v5.0.3 through v6.0 with pre-installed applications that use the web_webview component is vulnerable. OpenHarmony runs on more than one billion devices, including smartphones, tablets, smart TVs, and industrial infrastructure, so the affected surface is large.
Vendor Security History
The OpenHarmony project, governed by the OpenAtom Foundation, is its own CVE Numbering Authority. For this vulnerability, the project took a proactive approach: it published branch-specific fixes promptly and disclosed the issue through its official security disclosure channel. Coordinated disclosure and multi-branch patching suggest a mature vulnerability response process. Getting those fixes through more than five hundred hardware partners, each with its own firmware update cycle, is still a practical concern.
