Control Logic Flaw in Kids Mode Webpage Allows Unauthorized Photo Access by Vivo
CVE-2026-15366

2.4LOW

Key Information:

Vendor

Vivo

Status
Kids Mode
Vendor
CVE Published:
26 August 2026

What is CVE-2026-15366?

A flaw in the control logic of Vivo's Kids Mode allows users to access and view local gallery photos directly from a built-in webpage. This vulnerability poses a privacy risk, as unauthorized individuals may exploit this defect to view sensitive photos stored on the device without proper restrictions.

Affected Version(s)

Kids Mode Versions below 4.9.7.0

References

https://www.vivo.com/en/support/security-advisory-detail?...

CVSS V4

Score:
2.4
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Physical
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.