A flaw in the web_webview component manifests as an out-of-bounds write that can be triggered by a remote attacker to execute arbitrary code when a pre-installed application is loaded. The vulnerability is identified as CWE‑787 and can compromise the confidentiality, integrity, and availability of the device. The official description does not specify authentication or privilege requirements; based on the description, it is inferred that no authentication or privilege is needed to exploit the issue, allowing a remote attacker to succeed once the vulnerable component is invoked.

OpenHarmony 6.0 and earlier. All pre-installed applications shipped in these releases contain the vulnerable web_webview component and are therefore susceptible.

The CVSS score of 8.8 reflects high severity. EPSS is not provided, and the flaw is not listed in the CISA KEV catalog, so current exploitation probability is uncertain. Based on the description, a remote attacker can exploit the issue via the network by sending a malicious payload to the web view component of a pre‑installed app, leading to complete control of the affected device.