Threats tagged 'ghsa-4gjg-wxmg-j29w'

Xiaomi Mi Browser Android Application versions before 14.66.0-gn contain a path traversal vulnerability in the exported ThirdDocViewerActivity component. This flaw allows a zero-permission malicious app to supply a crafted content provider with a filename containing '..' sequences, causing the browser to write attacker-controlled data outside the intended cache directory in external storage without user interaction.