CVE-2018-20523

MEDIUM 5.3CVE-2018-20523 · Published 07/06/2019 · updated 17/06/2026

In short

CVE-2018-20523 is a MEDIUM (CVSS 5.3) vulnerability affecting stock browser (mi).
Chance of exploitation in the next 30 days (EPSS): 10.0%, higher than 95.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
stock browser mi	`= 10.2.4g`	No fix yet

Description

Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection. In other words, a third-party application can read the user's cleartext browser history via an app.provider.query content://com.android.browser.searchhistory/searchhistory request.

References

packetstormsecurity.com/files/163796/Xiaomi-10.2.4.g-Information-Disclosure.html · Exploit
sec.xiaomi.com · Broken Link
vishwarajbhattrai.wordpress.com/2019/03/22/content-provider-injection-in-xiaomi-stock-browser · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free