CVE-2026-18907

CVE-2026-18907 identifies a path traversal vulnerability in the download file feature of TECNO Hi Browser (com.talpa.hibrowser) version 2.23.1.1 on Android . The root cause is that the application trusts an attacker-controlled Content-Disposition filename and joins it with the download directory ...