VulnerabilityModified

CVE-2025-67316

An issue in realme Internet browser v.45.13.4.1 allows a remote attacker to execute arbitrary code via a crafted webpage in the built-in HeyTap/ColorOS browser.

MEDIUM 5.4EPSS 0.28%

Does this matter?

Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own.

Description

An issue in realme Internet browser v.45.13.4.1 allows a remote attacker to execute arbitrary code via a crafted webpage in the built-in HeyTap/ColorOS browser. NOTE: The supplier is currently disputing this finding and the record is under review.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS: 0.28% probability · 21th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: heytap/internet browser
Source: cve@mitre.org

References

https://c.realme.com/in/post-details/1171957723898576896
https://gist.github.com/Brucewebva/ceb365b7cea0d0b8ec0ce6755177de83Exploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.