Galaxy Store CVE-2026-20976

Improper URL validation from MCSLaunch deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute Ja

XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API

InstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 al

Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to execu

Improper access control vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to install applic

Improper input validation vulnerability in BillingPackageInsraller in Galaxy Store prior to version 4.5.41.8 allows loca

Improper input validation vulnerability in ApexPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local a

Improper input validation vulnerability in AppsPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local a

Improper access control vulnerability in Galaxy Store prior to version 4.5.36.4 allows attacker to install applications

Improper URL validation from InstantPlay deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute

Galaxy Store versions prior to 4.6.03.8 contain an access control flaw that enables local attackers to create files with

Improper Access Control vulnerability in Galaxy Store prior to version 4.5.53.6 allows local attacker to access protecte