CVE-2026-123993 Hisense VIDAA Smart TV Unauthenticated WebDriver Remote Access
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123993?
CVE-2026-123993 is a high-severity vulnerability in Hisense VIDAA, published on 6 Nov 2026.
Official description
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability where a QA build of the Google Cobalt browser engine exposes the WebDriver automation server on TCP port 4444 across all network interfaces without any authentication or pairing requirement. A LAN-adjacent attacker can connect to the exposed WebDriver service to execute arbitrary JavaScript, read and exfiltrate sensitive localStorage data including ACR telemetry, MAC addresses, ad-service credentials, and location data, inject persistent content onto the display, and access the window.hisense native bridge to perform filesystem read/write and system-state operations.
Which versions are affected by CVE-2026-123993?
How do I fix CVE-2026-123993?
No fix has been published for CVE-2026-123993 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123993 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-123993 exists.
Sources
Also known as GHSA-fc56-2cmc-39gc.