What’s Vulnerable › Vulnerabilities

CVE-2018-20523

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 10.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-06-07 · updated 2026-06-17
• Weakness: CWE-77

Description

Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection. In other words, a third-party application can read the user's cleartext browser history via an app.provider.query content://com.android.browser.searchhistory/searchhistory request.

Affected products

• Mi Redmi 4A Firmware: all versions
• Mi Redmi 5 Plus Firmware: all versions
• Mi Redmi 6 Firmware: all versions
• Mi Redmi 6A Firmware: all versions
• Mi Redmi 7 Firmware: all versions
• Mi Redmi 7A Firmware: all versions
• Mi Redmi Go Firmware: all versions
• Mi Redmi K20 Firmware: all versions
• Mi Redmi K20 Pro Firmware: all versions
• Mi Redmi Note 4 Firmware: all versions
• Mi Redmi Note 5 Firmware: all versions
• Mi Redmi Note 5 Pro Firmware: all versions
• Mi Redmi Note 5A Prime Firmware: all versions
• Mi Redmi Note 6 Pro Firmware: all versions
• Mi Redmi Note 7 Firmware: all versions
• Mi Redmi Note 7S Firmware: all versions
• Mi Redmi S2 Firmware: all versions
• Mi Redmi Y3 Firmware: all versions
• Mi Stock Browser: 10.2.4g

References

• http://packetstormsecurity.com/files/163796/Xiaomi-10.2.4.g-Information-Disclosure.html
• https://sec.xiaomi.com
• https://vishwarajbhattrai.wordpress.com/2019/03/22/content-provider-injection-in-xiaomi-stock-browser
• http://packetstormsecurity.com/files/163796/Xiaomi-10.2.4.g-Information-Disclosure.html
• https://sec.xiaomi.com
• https://vishwarajbhattrai.wordpress.com/2019/03/22/content-provider-injection-in-xiaomi-stock-browser

Get alerted when CVE-2018-20523 or the next vulnerability affects your stack