CVE-2025-67316: Heytap Internet Browser RCE Vulnerability

CVE-2025-67316 Overview

CVE-2025-67316 affects the Realme Internet Browser version 45.13.4.1, the built-in HeyTap/ColorOS browser distributed on Realme mobile devices. A remote attacker can execute arbitrary code by delivering a crafted webpage to a victim using the vulnerable browser. The issue is categorized as a cross-site scripting weakness [CWE-79], allowing script injection in the browser rendering context. The supplier is currently disputing this finding, and the record remains under review at the National Vulnerability Database (NVD).

Critical Impact
A remote attacker can execute arbitrary script code in the browser context by luring a user to a malicious webpage, potentially compromising session data and browsing integrity.

Affected Products

Realme Internet Browser version 45.13.4.1
HeyTap Internet Browser (shared codebase)
ColorOS built-in browser using the same rendering component

Discovery Timeline

2026-01-05 - CVE-2025-67316 published to NVD
2026-07-05 - Last updated in NVD database (record under review, vendor dispute noted)

Technical Details for CVE-2025-67316

Vulnerability Analysis

CVE-2025-67316 is a cross-site scripting (XSS) issue [CWE-79] in the Realme Internet Browser bundled with HeyTap and ColorOS devices. The browser fails to properly neutralize script content served through a crafted webpage. When a user navigates to attacker-controlled content, injected script executes within the browser rendering context. The advisory language references arbitrary code execution, which in the context of a browser XSS flaw refers to arbitrary JavaScript execution in the page origin, not native code execution on the device.

The attack requires user interaction, since the victim must load the malicious page. No authentication or elevated privileges are needed on the target device. The supplier disputes the finding, and no vendor-issued patch reference is currently listed in NVD.

Root Cause

The root cause is improper neutralization of input during web page generation or rendering within the Realme Internet Browser. Content delivered by a crafted webpage is processed without sufficient sanitization or context-aware output encoding. This permits attacker-controlled script to run in the browser's rendering pipeline.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a crafted webpage and drives the victim to it through phishing links, malvertising, or a compromised site. When the vulnerable browser renders the page, embedded payload script executes and can read page content, exfiltrate cookies scoped to the loaded origin, or manipulate the displayed page. Public proof-of-concept material is referenced in a third-party GitHub Gist Exploit Code resource.

No verified exploitation code is reproduced here. See the Realme Security Post for the vendor community response.

Detection Methods for CVE-2025-67316

Indicators of Compromise

Outbound HTTP or HTTPS connections from mobile devices to newly registered or low-reputation domains hosting rendered pages
Unexpected JavaScript payloads in browser cache directories on Realme, HeyTap, or ColorOS devices running browser version 45.13.4.1
Session cookie reuse from IP addresses inconsistent with normal user geography, indicating token theft via injected script

Detection Strategies

Inspect mobile web proxy and DNS logs for user agents matching the Realme/HeyTap browser combined with visits to untrusted hosts
Monitor enterprise identity providers for anomalous session activity originating after mobile browsing events
Correlate mobile device management (MDM) inventory to identify endpoints running Realme Internet Browser 45.13.4.1 and prioritize their traffic for review

Monitoring Recommendations

Enable TLS-inspecting mobile web gateways for corporate-managed Realme devices where policy allows
Alert on outbound requests to domains flagged in phishing threat feeds when the user agent identifies the HeyTap/ColorOS browser
Track authentication anomalies immediately after browser sessions on affected device models

How to Mitigate CVE-2025-67316

Immediate Actions Required

Inventory managed mobile fleets to identify Realme, HeyTap, and ColorOS devices running Internet Browser 45.13.4.1
Instruct users to avoid the built-in browser for sensitive activity and use a vendor-maintained alternative browser until the dispute is resolved
Enforce phishing-resistant multi-factor authentication (MFA) to reduce impact of stolen session tokens

Patch Information

No vendor-issued patch is currently referenced in NVD. The supplier is disputing the finding, and the record is under review. Monitor the Realme Security Post and vendor update channels for further guidance and any subsequent browser updates.

Workarounds

Restrict use of the built-in HeyTap/ColorOS browser through MDM app policies where feasible
Deploy an alternative, actively maintained mobile browser for corporate use on affected devices
Apply DNS filtering and web reputation services on mobile networks to block known malicious hosts before content reaches the browser

bash

# Example MDM query to identify affected browser version
# Adjust for your MDM platform's query syntax
mdm-cli devices list \
  --filter "app.package=com.heytap.browser" \
  --filter "app.version=45.13.4.1" \
  --output vulnerable-devices.csv