A critical race condition in Huawei HarmonyOS 6.0.0 and 6.1.0 could allow a local attacker to bypass permission controls and gain elevated system access.

This is a race condition vulnerability (CWE-362) involving shared resources with improper synchronization. The CVSS vector (AV:L/AC:L/PR:N/UI:N) indicates this is an unauthenticated, local-access vulnerability that does not require user interaction.

The ability to exploit race conditions in a mobile operating system can lead to privilege escalation and full compromise of device security. With a CVSS score of 8.4, this vulnerability poses a severe risk to the confidentiality, integrity, and availability of data stored on affected Huawei devices.

Immediate Action: Apply the latest security updates provided by Huawei for the affected HarmonyOS versions as detailed in their May 2026 security bulletin.

Proactive Monitoring: Monitor system logs for unexpected privilege changes or crashes that may indicate an attempt to trigger a race condition.

Compensating Controls: Ensure device integrity protections and restricted app installation policies are strictly enforced to minimize the risk of malicious local code execution.

Public Exploit Available: Unknown.

Users and administrators of Huawei devices running HarmonyOS 6.0.0 or 6.1.0 must apply security patches immediately upon availability. Prioritize devices handling sensitive enterprise data to mitigate the risk of unauthorized privilege escalation.