CVE-2026-18907 describes a path traversal vulnerability in the Download File feature of com.talpa.hibrowser version 2.23.1.1 on Android. By including directory traversal sequences in the filename, an attacker can cause arbitrary file writes. The vulnerability is classified under CWE-23 (Relative Path Traversal). The CVSS v3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. There is no information about patches or fixes, and no known exploits in the wild have been reported.

The vulnerability allows an unauthenticated attacker to write arbitrary files on the affected device, potentially leading to denial of service or disruption of normal application or system operation. There is no direct impact on confidentiality or integrity according to the CVSS vector. The high severity rating is due to the potential availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when downloading files using this feature and avoid untrusted sources. Monitor vendor communications for updates on patches or mitigations.