EUVD-2026-34805
GHSA-24v9-59pc-wmrv
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (SamsungMobile) · only source for this CVE.
CVSS VectorVendor: SamsungMobile
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Improper export of android application components in ExpressHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script.
AnalysisAI
Improper export of the ExpressHomeWidgetReceiver Android component in Samsung Assistant (prior to version 9.3.14) enables a local attacker without special privileges to send crafted intents to the exposed receiver and execute arbitrary scripts on the device. The CVSS 4.0 score of 6.9 reflects high confidentiality impact (VC:H) with a local attack vector - an on-device malicious application is a realistic threat model. No public exploit has been identified and this CVE does not appear in CISA KEV at time of analysis.
Technical ContextAI
Samsung Assistant is a Samsung-developed AI assistant application for Android devices, identified by CPE cpe:2.3:a:samsung_mobile:samsung_assistant:*:*:*:*:*:*:*:*. The vulnerability resides in ExpressHomeWidgetReceiver, an Android BroadcastReceiver component. In Android, application components such as BroadcastReceivers can be declared as exported in the AndroidManifest.xml, making them reachable by other applications on the same device. When exported without enforcing custom permissions or intent filters with adequate restrictions, any local application can send arbitrary intents to the component. This class of vulnerability is characteristic of improper Android component export patterns - conceptually aligned with CWE-926 (Improper Export of Android Application Components) - though no formal CWE is assigned to this CVE. The 'Google' tag in the source intelligence likely reflects the Android platform context rather than a distinct Google product being affected.
RemediationAI
The primary fix is to update Samsung Assistant to version 9.3.14 or later, as confirmed by the Samsung Mobile Security June 2026 advisory at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=06. Updates are typically delivered via the Galaxy Store or Samsung Software Update mechanism on affected devices. As a compensating control on devices that cannot be immediately updated, administrators managing enterprise Android fleets via MDM should enforce app allowlisting policies to prevent untrusted third-party applications from being installed - this directly removes the threat actor's necessary foothold, since exploitation requires a malicious app running locally on the device. Restricting sideloading (disabling 'Install unknown apps' in Android settings) reduces the attack surface further, though it does not eliminate risk from apps distributed via the Play Store. Note that these compensating controls impose usability restrictions and do not address the underlying component export flaw.
Arbitrary file write as SYSTEM in Samsung MagicINFO 9 Server before version 21.1050 allows remote attackers to place att
Samsung MagicINFO 9 Server contains a path traversal vulnerability allowing unauthenticated attackers to write arbitrary
Multiple stack-based buffer overflows in the BackupToAvi method in the (1) UMS_Ctrl 1.5.1.1 and (2) UMS_Ctrl_STW 2.0.1.0
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_u
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an un
Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive informat
Buffer overflow in the PrepareSync method in the SyncService.dll ActiveX control in Samsung Kies before 2.5.1.12123_2_7
The Samsung D6000 TV and possibly other products allow remote attackers to cause a denial of service (continuous restart
The Samsung D6000 TV and possibly other products allows remote attackers to cause a denial of service (crash) via a long
The ConnectDDNS method in the (1) STWConfigNVR 1.1.13.15 and (2) STWConfig 1.1.14.13 ActiveX controls in Samsung NET-i v
Multiple directory traversal vulnerabilities in Samsung SyncThru 6 before 1.0 allow remote attackers to delete arbitrary
Stack-based buffer overflow in the RequestScreenOptimization function in the XProcessControl.ocx ActiveX control in msls
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today