CVE-2026-127209

Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulnerability in the exported ThirdDocViewerActivity component, where CopyExternalFile.copyFromUri() copies content provider streams using an unsanitized filename from the display name column without basename reduction or canonical-path checks. A zero-permission co-resident malicious application can supply a crafted content provider with a display name containing .. sequences to make the browser write attacker-controlled bytes to an arbitrary path within its external storage directory, escaping the intended cache docs staging location without requiring user interaction.