An issue in realme Internet browser v.45.13.4.1 allows a remote attacker to execute arbitrary code via a crafted webpage in the built-in HeyTap/ColorOS browser. NOTE: The supplier is currently disputing this finding and the record is under review.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00078.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
n/a n/a affected
Version Status Constraints
n/a affected
—

Configuration 1 [-]

cpe:2.3:a:heytap:internet_browser:45.13.4.1:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions
Realme Coloros — —
Realme Hey Tap Coloros Browser — —

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Subscriptions

Vendors Products
Heytap Subscribe
Internet Browser Subscribe
Realme Subscribe
Coloros Subscribe
Hey Tap Coloros Browser Subscribe

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://internet.com cve-icon cve-icon
http://realme.com cve-icon cve-icon
https://gist.github.com/Brucewebva/ceb365b7cea0d0b8ec0ce6755177de83 cve-icon cve-icon
History

Thu, 26 Mar 2026 18:30:00 +0000

Type Values Removed Values Added
Description An issue in realme Internet browser v.45.13.4.1 allows a remote attacker to execute arbitrary code via a crafted webpage in the built-in HeyTap/ColorOS browser An issue in realme Internet browser v.45.13.4.1 allows a remote attacker to execute arbitrary code via a crafted webpage in the built-in HeyTap/ColorOS browser. NOTE: The supplier is currently disputing this finding and the record is under review.

Fri, 30 Jan 2026 01:30:00 +0000

Type Values Removed Values Added
First Time appeared Heytap
Heytap internet Browser
CPEs cpe:2.3:a:heytap:internet_browser:45.13.4.1:*:*:*:*:*:*:*
Vendors & Products Heytap
Heytap internet Browser

Tue, 06 Jan 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Realme
Realme coloros
Realme hey Tap Coloros Browser
Vendors & Products Realme
Realme coloros
Realme hey Tap Coloros Browser

Tue, 06 Jan 2026 00:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 05 Jan 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

Mon, 05 Jan 2026 16:30:00 +0000

Type Values Removed Values Added
Description An issue in realme Internet browser v.45.13.4.1 allows a remote attacker to execute arbitrary code via a crafted webpage in the built-in HeyTap/ColorOS browser
References
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-03-26T18:24:23.924Z

Reserved: 2025-12-08T00:00:00.000Z

Link: CVE-2025-67316

cve-icon Vulnrichment

Updated: 2026-01-05T21:09:08.899Z

cve-icon NVD

Status : Modified

Published: 2026-01-05T17:15:46.400

Modified: 2026-03-26T19:16:31.660

Link: CVE-2025-67316

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-01-06T14:17:16Z

Weaknesses