Samsung Escargot CVE-2026-14160

Exploitation requires local execution context on a system running the vulnerable Escargot JavaScript engine - either direct local access or the ability to supply JavaScript for the engine to evaluate (e.g., via a sideloaded or compromised TV application). The CVSS vector specifies AV:L (local attack vector), meaning remote unauthenticated exploitation over a network is not applicable. The race condition requires the attacker to control timing and trigger concurrent access to the vulnerable shared resource; this is an inherent complexity barrier even though the vector lists AC:L. Exploitation is limited to the impact scope of the engine process (C:L/I:L/A:L, S:U) and does not affect other system components or cross a security boundary. No special non-default configuration is cited - the flaw is present in the engine's default execution path - but the local-only vector and timing requirement are meaningful limiting factors.

The NVD-assigned CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) yields a Medium score of 5.9. However, the AC:L assignment is inconsistent with TOCTOU mechanics, which inherently require timing precision to win the race window - AC:H is more appropriate, and the score should be treated accordingly (reducing real-world exploitability). PR:N is plausible if exploitation occurs via crafted JavaScript input without requiring OS-level privileges, consistent with the embedded TV appliance context where untrusted app code may run in the engine. KEV status is absent and no POC is publicly known, placing this in the 'no public exploit identified at time of analysis' category. The limited C:L/I:L/A:L impact triad and local attack vector significantly constrain blast radius. Real-world prioritization should be low unless Escargot is exposed to untrusted third-party JavaScript on affected Samsung devices, in which case the integrity and information disclosure risks become more relevant. The AC:L versus the TOCTOU nature is a notable inconsistency - defenders should verify with Samsung whether reliable exploitation has been demonstrated.

A local attacker or a malicious application running on a Samsung TV appliance submits crafted JavaScript designed to repeatedly trigger the vulnerable code path and win the timing window between the security check and resource use. By racing the check-use sequence - for example, swapping an object or memory reference after validation but before consumption - the attacker achieves a limited read of protected data or corrupts engine state. No public proof-of-concept exists at time of analysis, and winning the race reliably is non-trivial, reducing the practical threat.