{"id":"CVE-2026-123993","published":"2026-11-06T19:17:44.550","lastModified":"2026-11-09T23:17:17.520","description":"Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability where a QA build of the Google Cobalt browser engine exposes the WebDriver automation server on TCP port 4444 across all network interfaces without any authentication or pairing requirement. A LAN-adjacent attacker can connect to the exposed WebDriver service to execute arbitrary JavaScript, read and exfiltrate sensitive localStorage data including ACR telemetry, MAC addresses, ad-service credentials, and location data, inject persistent content onto the display, and access the window.hisense native bridge to perform filesystem read/write and system-state operations.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306","CWE-489"],"vendors":[],"products":[],"references":[{"url":"https://github.com/yehia-mamdouh/Hisense-Smart-TV-Security-Research","tags":[]},{"url":"https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-unauthenticated-webdriver-remote-access","tags":[]}],"exploitRefs":[{"url":"https://github.com/yehia-mamdouh/Hisense-Smart-TV-Security-Research","tags":[]}],"hasPoc":true,"ai":{"summary":"A QA build of the Google Cobalt browser engine in Hisense VIDAA Smart TV firmware exposes an unauthenticated WebDriver server on TCP port 4444, allowing LAN-adjacent attackers to execute arbitrary JavaScript and access sensitive data and system functions via the exposed automation interface.","exploitability":"Exploitation requires only network access to the TV on the same LAN segment, no authentication or user interaction, and is trivial for an attacker with basic scripting skills.","blast_radius":"Successful exploitation enables full compromise of user privacy (telemetry, credentials, location), persistent display manipulation, and low-level system control including filesystem read/write via the native bridge.","remediation":"Upgrade to firmware version V0000.01.00a.P0221 or later, which disables the WebDriver server in production builds; if unavailable, disable the WebDriver service by blocking TCP port 4444 at the network perimeter and disabling QA build features via firmware configuration.","detection":"Defenders should monitor for outbound connections from TV devices to internal network IPs on TCP port 4444, or inbound connections to port 4444 from non-authorized hosts on the same subnet; no standard log entries are generated by the vulnerable service itself.","tags":["webdriver-exposure","unauthenticated-access","iot","local-network","native-bridge-abuse"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:51:40.489Z"}}