Hisense VIDAA Smart TV firmware: Unauthenticated WebDriver access (CVE-2026-123993)

Hisense VIDAA Smart TV firmware version V0000.01.00a.P0220 contains a vulnerability stemming from the inclusion of a QA build of the Google Cobalt browser engine. This build exposes a WebDriver automation server on TCP port 4444 across all network interfaces without requiring authentication or pairing.

Impact

An attacker on the same local network can interface with the exposed service to execute arbitrary JavaScript within the browser context. This allows for the exfiltration of sensitive localStorage data, including ad-service credentials, MAC addresses, location data, and ACR telemetry. Furthermore, the attacker can leverage the window.hisense native bridge to execute filesystem read/write operations and modify system-state.

Recommendation

• Inventory all Hisense VIDAA Smart TV devices on the network to identify those running firmware version V0000.01.00a.P0220.
• Restrict network access to the devices, specifically blocking incoming connections to TCP port 4444 from untrusted network segments.
• Monitor network traffic for connections to port 4444 originating from unauthorized local IP addresses.