CVE-2018-20523: Mi Redmi 4a Firmware

Medium severity, CVSS 5.3. EPSS: 10% chance of exploitation in the next 30 days.

Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection. In other words, a third-party application can read the user's cleartext browser history via an app.provider.query content://com.android.browser.searchhistory/searchhistory request.

Affected products

• Mi Redmi 4a Firmware: affected versions not specified
• Mi Redmi 5 Plus Firmware: affected versions not specified
• Mi Redmi 6 Firmware: affected versions not specified
• Mi Redmi 6a Firmware: affected versions not specified
• Mi Redmi 7 Firmware: affected versions not specified
• Mi Redmi 7a Firmware: affected versions not specified
• Mi Redmi Go Firmware: affected versions not specified
• Mi Redmi k20 Firmware: affected versions not specified
• Mi Redmi k20 Pro Firmware: affected versions not specified
• Mi Redmi Note 4 Firmware: affected versions not specified
• Mi Redmi Note 5 Firmware: affected versions not specified
• Mi Redmi Note 5 Pro Firmware: affected versions not specified
• Mi Redmi Note 5a Prime Firmware: affected versions not specified
• Mi Redmi Note 6 Pro Firmware: affected versions not specified
• Mi Redmi Note 7 Firmware: affected versions not specified
• Mi Redmi Note 7s Firmware: affected versions not specified
• Mi Redmi s2 Firmware: affected versions not specified
• Mi Redmi y3 Firmware: affected versions not specified
• Mi Stock Browser: version 10.2.4g only

Published 2019-06-07. Last modified 2026-06-17.