CVE-2026-18907 Overview
CVE-2026-18907 is a path traversal vulnerability in the download file feature of com.talpa.hibrowser version 2.23.1.1 on Android. The flaw allows arbitrary file write through directory traversal sequences embedded in the filename parameter. An attacker can craft a malicious download response that writes files outside the browser's intended storage directory. This weakness maps to CWE-23: Relative Path Traversal. Successful exploitation can overwrite application data or drop attacker-controlled files into sensitive locations accessible to the browser process.
Critical Impact
Attackers can write arbitrary files to locations writable by the HiBrowser Android application, potentially leading to code execution or persistence on the device.
Affected Products
- com.talpa.hibrowser (HiBrowser) version 2.23.1.1 on Android
- Tecno Mobile devices shipping the affected HiBrowser package
- Any Android installation with the vulnerable HiBrowser APK installed
Discovery Timeline
- 2026-08-05 - CVE-2026-18907 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-18907
Vulnerability Analysis
The vulnerability resides in the download file feature of the HiBrowser Android application. The download handler accepts a filename value from an untrusted source and uses it to construct the destination path without sanitizing directory traversal sequences. An attacker who controls the server response, or who lures a user to a malicious page, can supply a filename containing ../ sequences. The browser resolves the path outside its designated download directory and writes attacker-controlled content there. The EPSS score is 0.241% with a percentile of 15.253, reflecting a low predicted exploitation rate at publication.
Root Cause
The root cause is missing input validation on the filename component supplied to the download routine. The application concatenates the filename with a base directory without normalizing the resulting path or rejecting relative traversal tokens. Because Android applications hold write access to their private data directory and to shared external storage, the resolved path can land in security-sensitive locations. This is a classic [CWE-23] relative path traversal pattern.
Attack Vector
An attacker hosts a malicious website or intercepts a download response to a targeted user. The response advertises a filename such as ..%2F..%2Fdatabases%2Fpreferences.xml or a similar traversal payload. When the victim triggers the download in HiBrowser 2.23.1.1, the application writes the attacker-supplied bytes to the traversed path. Overwriting application configuration, shared preferences, or WebView cache files can lead to privilege abuse, session takeover, or code loading during subsequent app launches. See the Tecno Security Updates advisory for vendor guidance.
Detection Methods for CVE-2026-18907
Indicators of Compromise
- Files created by the HiBrowser process outside its expected download directory, particularly under the app's private data path or WebView storage.
- HTTP responses to the HiBrowser user agent containing Content-Disposition headers with filename values embedding ../, ..\, or URL-encoded traversal sequences.
- Unexpected modifications to com.talpa.hibrowser shared preferences, databases, or cached JavaScript.
Detection Strategies
- Inspect mobile network telemetry for download responses whose filename metadata contains encoded or literal directory traversal characters.
- Audit installed application versions across managed Android fleets and flag com.talpa.hibrowser at version 2.23.1.1 or earlier.
- Correlate file-write events from mobile threat defense agents with the HiBrowser package UID to spot writes outside the sandboxed download folder.
Monitoring Recommendations
- Enable mobile threat defense logging for file system anomalies on devices running HiBrowser and forward events to a centralized SIEM.
- Monitor for outbound connections from HiBrowser to newly observed or low-reputation domains that could deliver traversal payloads.
- Track application update status across the fleet and alert when vulnerable versions remain installed after a patched release is available.
How to Mitigate CVE-2026-18907
Immediate Actions Required
- Update com.talpa.hibrowser to the latest version distributed by Tecno through the device app store or system update channel.
- Restrict use of HiBrowser 2.23.1.1 on managed devices via mobile device management policy until the patched build is deployed.
- Advise users to avoid downloading files from untrusted websites while running the vulnerable version.
Patch Information
Refer to the Tecno Security Updates portal for the fixed HiBrowser version and rollout details. Apply the vendor-supplied update to all affected Android devices as soon as it is available in the appropriate distribution channel.
Workarounds
- Disable or uninstall HiBrowser on affected devices and use an alternative browser until the patch is applied.
- Block download traffic to HiBrowser at the network layer by enforcing HTTPS inspection and stripping responses containing traversal sequences in Content-Disposition filenames.
- Revoke storage permissions from com.talpa.hibrowser where feasible to limit the write scope available to the vulnerable download routine.
# Configuration example: identify vulnerable HiBrowser installs via ADB
adb shell pm list packages --show-versioncode | grep com.talpa.hibrowser
adb shell dumpsys package com.talpa.hibrowser | grep versionName
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
