Vulnerability Disclosure Policy

Last updated: 23 October 2026

1. Purpose and Commitment

TCL is committed to the security of its products and to the responsible, coordinated handling of security vulnerabilities. This Vulnerability Disclosure Policy (VDP) explains how security researchers, customers, business partners and any other party can report security vulnerabilities to TCL, how TCL responds to and remediates them, and how fixes and security advisories are published.

This policy applies worldwide to TCL products with digital elements, including smart TVs, mobile devices, smart home appliances and other hardware or software products, including firmware and mobile applications. It also covers cloud-based or other online services that form an integral part of the functionality of those products. The scope of vulnerability reports covered by this policy is further specified in Section 2.

This policy establishes a common framework for vulnerability reporting and handling across markets. Applicable legal requirements in each jurisdiction continue to apply. For products subject to Regulation (EU) 2024/2847 (Cyber Resilience Act, CRA), this policy also supports compliance with the applicable requirements of that Regulation. Nothing in this policy limits any mandatory rights or obligations under applicable law.

In this policy, “TCL” or “we” refers to the relevant legal entity within the TCL group responsible for the product under applicable law. The responsible entity’s name and contact details are provided in the relevant product labelling, accompanying documentation or applicable product information. Different TCL legal entities may be responsible for different products and markets. Each entity retains its obligations under applicable law, including the manufacturer’s obligations under the CRA where applicable. This policy does not transfer or exclude any legal responsibilities of manufacturers, importers, distributors or authorised representatives.

Handling vulnerabilities in a coordinated manner is a shared effort. We thank the security community for its contributions and commit to engaging constructively with every report submitted in good faith.

2. Scope

In scope:

• Security vulnerabilities in the TCL products with digital elements described in Section 1 that are within their support period (see Section 11), including vulnerabilities in their hardware, firmware, software and mobile applications, and in cloud-based or other online services that form an integral part of the functionality of those products.
• Vulnerabilities in third-party components integrated into those products, including commercial and free and open-source components, and their potential impact on the covered TCL products.
• For products within their support period, reports concerning any firmware or software version released during that period are accepted. Researchers are encouraged, but not required, to test against the latest version.

The support-period limitation does not remove any applicable statutory reporting or user-notification obligations described in Section 10.

Out of scope:

• Social engineering of TCL staff or contractors;
• Unauthorised physical access to TCL premises or tampering with devices that the researcher does not own or have permission to test;
• Denial-of-service or resource-exhaustion testing against production systems, shared services or third-party devices, or any testing that could disrupt services or affect other users;
• Spam or mass-credential attacks;
• Vulnerabilities in standalone third-party applications or services that are neither integrated into products covered by this policy nor provided or maintained by TCL; these should be reported to the relevant vendor;
• Issues already publicly known that do not identify any new impact, affected product or version, or remediation requirement.

Restrictions on testing activities do not, by themselves, exclude the underlying vulnerabilities from assessment and handling. These exclusions do not limit TCL’s applicable legal obligations regarding vulnerability handling, remediation, reporting or user notification.

3. How to Report a Vulnerability

TCL accepts vulnerability reports through the reporting channels listed below. Email and the TCL SRC platform are equally valid for report acceptance, tracking and acknowledgement. Reports received through either channel are recorded in the internal tracking system and assigned a tracking identifier.

Researchers who cannot or prefer not to use the TCL SRC platform may submit reports directly by email. Encryption is encouraged for sensitive information but is not a prerequisite for report acceptance.

The availability of a submission channel does not mean that it is continuously staffed. Routine response targets are set out in Section 5; applicable statutory reporting deadlines are addressed separately in Section 10.

4. Information to Include

To help us reproduce and assess the issue quickly, please include as much of the following as possible:

• Product model, hardware revision, firmware or software version, and serial number (if available);
• Step-by-step description of the vulnerability and how to reproduce it;
• Proof of concept or crash dumps, where available;
• Potential impact, including whether the issue could be exploited remotely, without authentication, or at scale;
• Any observation of public discussion or active exploitation of the issue.

Please avoid including unnecessary personal data, credentials or other sensitive information. If additional sensitive material is needed for verification, TCL will coordinate an appropriate means of exchange.

5. Handling Process and Timeframes

TCL acknowledges receipt of vulnerability reports and performs an initial assessment to determine their relevance, validity and potential impact. Receipt acknowledgement does not depend on prior confirmation that a reported issue is a valid vulnerability.

The following response targets apply to reports received through either reporting channel. Remediation targets apply to confirmed vulnerabilities affecting covered products and are measured from the date the report was received, not from the date of validation or internal assignment. Where a report cannot be validated or is outside the applicable scope, TCL will inform the researcher of the outcome and the reasons, where possible.

TCL will address and remediate vulnerabilities without undue delay, prioritising actively exploited vulnerabilities and those presenting significant risks to users. Where a complete fix is not yet available, TCL will provide available mitigation measures or protective guidance, as appropriate. If a remediation target needs to be revised, TCL will explain the reasons and communicate an updated target to the researcher. Revised targets do not automatically extend any disclosure timeline agreed with the researcher or extend applicable statutory reporting or user-notification deadlines.

6. Remediation, Advisories and Coordinated Disclosure

6.1 Fixes and Security Advisories

TCL will remediate security vulnerabilities without undue delay throughout the applicable support period. Security updates are provided free of charge through secure mechanisms and, where technically feasible, separately from functionality updates.

Once a security update or other corrective measure is available, TCL will publish or update information about the fixed vulnerability without undue delay on the TCL SRC security advisories page, subject to Sections 6.2 and 6.3.

Advisories describe the vulnerability, identify affected products and relevant versions, explain its impact and severity, and provide clear and accessible remediation or mitigation guidance. Security updates are accompanied by relevant information and instructions on any action users need to take.

6.2 Delayed Publication

In duly justified cases, TCL may temporarily delay publication of information about a fixed vulnerability where the security risks of publication outweigh its benefits, to allow users time to apply the patch. TCL will document and review the reasons, limit the delay to what is necessary, and publish promptly when those reasons no longer apply. Necessary protective guidance and user notifications will continue during the delay.

6.3 Separate Advisories and Existing Disclosures

A separate advisory is not required for issues that are not security vulnerabilities or do not affect covered products, or where the required vulnerability information and remediation guidance are already publicly available in an existing advisory or security update notice. Existing disclosures will be updated where new impacts or required actions are identified. This does not exempt TCL from applicable public-disclosure obligations.

6.4 Coordinated Disclosure

We ask researchers to refrain from publicly disclosing vulnerabilities before a fix is available and to contact TCL before any planned public disclosure to coordinate its timing and scope. TCL will provide progress updates and work with the researcher to avoid unreasonable delays in remediation and disclosure. Participation in the TCL SRC reward program is subject to its applicable rules.

Where necessary to protect users, TCL may publish protective guidance before a complete fix is available. This coordination does not affect applicable legal obligations.

7. Safe Harbor

TCL authorises good-faith security research on products within the scope of this policy, conducted in a manner that respects the requirements below. Subject to the requirements, TCL will not pursue legal action against, and will not refer for prosecution, a researcher who makes a good-faith report. If a researcher inadvertently causes impact beyond the intent of their testing, and stops and reports it, TCL will treat the activity as authorised.

• Interact only with your own accounts, devices and data; do not access, modify or delete data belonging to others;
• Stop testing and notify us immediately if unintended impact occurs;
• Do not exfiltrate data beyond the minimum proof necessary to demonstrate the vulnerability;
• Privacy of individuals must be respected; any personal data encountered must be deleted once the report is submitted.

These commitments apply only to matters within TCL’s legal authority. They do not bind third parties or restrict the lawful powers of public authorities.

8. Recognition

With the researcher's consent, valid reports are acknowledged by name or handle in the corresponding security advisory. Researchers are also invited to join the TCL Security Response Center (TCL SRC) program, where valid reports earn points and, where applicable, rewards under the published TCLSRC rules. Recognition is granted regardless of the channel used to submit the report.

9. Confidentiality and Information Sharing

TCL handles non-public vulnerability reports and related communications confidentially, subject to the coordinated disclosure provisions in Section 6 and the permitted or legally required information sharing described below.

Researcher identity is not disclosed publicly or to third parties without the researcher’s consent, except where disclosure is required by applicable law.

TCL uses software bills of materials (SBOMs) and other component records to identify affected components and versions and assess their impact on covered products. Where necessary, TCL coordinates with relevant component and platform suppliers to support timely remediation.

Vulnerability information may be shared, under confidentiality, with those suppliers for assessment and remediation, with computer security incident response teams (CSIRTs) and recognised coordination partners, and with competent authorities where required by applicable law, including Regulation (EU) 2024/2847.

10. Statutory Reporting under the CRA

This section describes statutory reporting and user-notification obligations under the CRA where that Regulation applies. For other jurisdictions, TCL will comply with applicable vulnerability and incident reporting and user-notification requirements. The CRA-specific deadlines below do not replace or limit obligations arising under other applicable laws.

TCL will promptly assess information from any source concerning vulnerabilities or security incidents that may affect its products with digital elements. Where the manufacturer becomes aware of an actively exploited vulnerability or a severe incident having an impact on product security within the meaning of Article 14 of the CRA, the responsible TCL legal entity will notify both the CSIRT designated as coordinator and ENISA through the Single Reporting Platform.

The following statutory deadlines apply:

The 24-hour and 72-hour deadlines apply continuously, including weekends and holidays, and are not extended by internal procedures.

TCL will inform affected users and, where appropriate, all users without undue delay about the vulnerability or incident and the corrective or mitigating measures they can take.

11. Support Period

TCL provides security updates for products covered by this policy for at least five years after the last unit of the relevant model is placed on the market anywhere in the world, and for a longer period where necessary to reflect the product’s reasonably expected period of use or to comply with applicable legal requirements.

Products approaching the end of their support period are listed on the security advisories page at least six months in advance.

Model-specific security support end dates, stated by month and year, are published on the Product Security Update Period page and made clearly accessible before purchase.

12. Policy Availability and Contact

This policy is publicly available on the TCL website. Questions about this policy may be sent to security@tcl.mom.