TECNO Mobile vulnerabilities and threats

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename.

CVE-2026-10510 is a medium severity cross-site scripting (XSS) vulnerability in the GeniexWebView component of the Transsion AI Assistant Lifestyle Android application (com.transsion.aiassistantlifestyle) version 1.3.0.002. It allows a remote attacker to execute arbitrary JavaScript in the WebView context via a crafted web_action_data URL parameter. This vulnerability can lead to partial confidentiality and integrity impacts but does not affect availability.

CVE-2026-0634 is a high-severity vulnerability in the AssistFeedbackService component of TECNO Mobile's TECNO Pova7 Pro 5G running HiOS V15.1.0. It allows local applications with limited privileges to execute arbitrary code with system-level permissions via command injection due to improper neutralization of argument delimiters. This vulnerability can lead to full compromise of confidentiality, integrity, and availability on affected devices. No public exploits are known at this time, and no patch or remediation information is currently available.

Insufficient Verification of Data Authenticity vulnerability in TECNO Mobile com.Afmobi.Boomplayer allows Authentication Bypass.This issue affects com.Afmobi.Boomplayer: 7.4.63.