Path Traversal Vulnerability in Xiaomi Mi Browser App

CVE-2026-127209

What is CVE-2026-127209?

The Xiaomi Mi Browser Android Application contains a path traversal vulnerability in the ThirdDocViewerActivity component. This flaw arises when the CopyExternalFile.copyFromUri() function processes content provider streams using an unsanitized filename derived from the _display_name column. As a result, an attacker with a zero-permission malicious application can craft a content provider containing directory traversal sequences. This enables the browser to write arbitrary data to any path within its external storage directory, circumventing the designated cache_docs staging area and allowing potential data leakage without user interaction.

References