The vulnerability is a race condition in the web_webview component that can be exploited by a remote attacker. When the race condition is triggered, the attacker can gain arbitrary code execution within the context of pre‑installed applications. This weakness corresponds to CWE‑364 and enables the attacker to take full control of the affected system by running arbitrary code.

OpenHarmony products, specifically all releases 6.0 and earlier. Any pre-installed applications running web_webview on those versions are impacted.

The CVSS base score of 8.1 indicates a high severity vulnerability. Because the EPSS score is not provided, the current probability of exploitation is unknown, but the lack of a KEV listing does not reduce concern. A remote attacker can trigger the race condition via web resources and gain code execution. There is no known public exploit yet, but the high severity plus lack of mitigation means the risk remains significant for systems still running affected versions.