A flaw in Lenovo’s Android Application, available only on Chinese‑market tablets, permits a website accessed via the device’s built‑in browser to overwrite the system clipboard. The weakness, classified as CWE‑749, allows the attacker to replace user data such as copied passwords or other sensitive information, potentially facilitating phishing or credential harvesting. The impact is limited to data confidentiality and integrity of the clipboard content; it does not grant code execution or widespread system compromise.*

The vulnerability affects the Lenovo Android Application on tablets sold exclusively in the Chinese market. No other Lenovo products or platform versions are listed as impacted. The affected version is the pre‑update release that ships with the application prior to version 7.3.8.

The CVSS score of 5.1 indicates a moderate severity. No EPSS value is provided, and the vulnerability is not listed in CISA’s KEV catalog, suggesting currently no evidence of active exploitation. Attack success requires a user to visit a malicious web page within the built‑in browser; the attacker can then inject a script that writes to the clipboard. The attack vector is local to the device, relying on user interaction with the browser, and does not exploit remote code execution or elevate privileges.*