EUVD-2026-55100
GHSA-grg8-xhr3-987r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable handler exploitable without attacker privileges, but requires victim to interact with a crafted link; only limited confidentiality impact, no integrity or availability effect.
Primary rating from Vendor (SamsungMobile).
CVSS VectorVendor: SamsungMobile
Lifecycle Timeline
1DescriptionCVE.org
Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information.
AnalysisAI
Improper authorization in the custom URL scheme handler of Samsung's My Galaxy app (all versions prior to 6.3) exposes sensitive information to remote attackers. The flaw exists because the handler processes inbound custom URL scheme invocations without enforcing adequate authorization checks, enabling an attacker-controlled web page or application to silently extract user data when a victim interacts with a crafted link. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | My Galaxy (any version prior to 6.3) must be installed on the target Samsung Galaxy device. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 5.3 (Medium) reflects a network-reachable, low-complexity vulnerability requiring no attacker privileges but necessitating passive user interaction (UI:P), which is the primary friction point limiting mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update My Galaxy to version 6.3 or later, which contains the authorization fix for the custom URL scheme handler. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today