Medium severity6.1NVD Advisory· Published Aug 2, 2023· Updated Jun 17, 2026

CVE-2023-26316

Description

A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account's cookies.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mi/Xiaomi Cloud
cpe:2.3:a:mi:xiaomi_cloud:*:*:*:*:*:*:*:*
Range: <=1.12.0.0.25
Xiaomi/cloud service Applicationdescription
Xiaomi/cloud service Applicationllm-create

Patches

Vulnerability mechanics

References

trust.mi.com/zh-CN/misrc/bulletins/advisorynvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000