Posts tagged

CWE-23
← Back to all posts
HB

Two Dots and a Slash: CVE-2026-18907 — Path Traversal in TECNO Hi Browser Turns a Download Into an Arbitrary File Write

On August 5, 2026, TECNO Mobile’s Security Response Center published CVE-2026-18907, a path-traversal vulnerability in Hi Browser (com.talpa.hibrowser) version 2.23.1.1 — TECNO’s first-party HiOS browser (the com.talpa.* application family on its Android handsets). N…

Android Vulnerability Mobile-Security Path-Traversal Hi-Browser CWE-23 TECNO
Read more

Tags

Account-Takeover android Android Android-Adb Android-apktool Android-Avd Android-Studio Anti-Bot Authentication Automotive Backslash-Breakout Baseband Buffer-Overflow C2 CAN-Bus Command-Injection Container-Escape Cross-Site-Scripting CWE-121 CWE-125 CWE-23 CWE-288 CWE-290 CWE-862 CWE-89 CWE-926 CWE-94 Data-Scraping Elixir Embedded-Systems Exploit Frida Geolocation GooglePlay Hardware Heap-Overflow Hi-Browser HTTP2 Hugging-Face Identity-Confusion Information Security Integer-Overflow IoT JNI Lexer-Differential Linux Linux-Kernel llama-cpp LLaMA-Factory LLM LwM2M MCP MediaTek Memory Disclosure Missing-Authorization mitmproxy Mobile-Security Network-Analysis Networking OAuth OAuth2 OBD2 OIDC OpenID-Connect Out-of-Bounds Page-Cache Path-Traversal Penetration Testing pgAdmin PHP Playwright PostgreSQL Privilege-Escalation Prompt-Injection Python Race-Condition RCE Reverse Engineering Reverse-Engineering Router Samsung-Bixby Samsung-Exynos Security Security-Research Session Hijacking SiYuan SMS Snapchat SNMP SQL-Injection SSL-Pinning STIG-Manager Supply-Chain TECNO Tenda Traefik Vulnerability Web Applications Web-Crawling Web-Security Wi-Fi Zephyr Zero-Day