My Galaxy CVE-2026-21075

My Galaxy (any version prior to 6.3) must be installed on the target Samsung Galaxy device. Exploitation requires passive user interaction (UI:P per the CVSS 4.0 vector) - specifically, the victim must click, tap, or otherwise trigger a link or redirect that invokes the My Galaxy custom URL scheme, such as via a malicious web page, phishing message, or rogue application. The attacker requires no account, no authentication, and no prior access to the device (PR:N, AV:N). Exploitation is limited to the information disclosure impact class (VC:L) with no integrity or availability consequence. Non-Samsung devices are not affected, as My Galaxy is a Samsung-exclusive application.

The CVSS 4.0 base score of 5.3 (Medium) reflects a network-reachable, low-complexity vulnerability requiring no attacker privileges but necessitating passive user interaction (UI:P), which is the primary friction point limiting mass exploitation. Confidentiality impact is low (VC:L) with no integrity or availability dimension. EPSS data was not provided in the intelligence feed, and no KEV listing exists, meaning widespread or automated exploitation has not been confirmed. The combination of PR:N and AV:N is notable - an attacker needs no account or foothold on the target - but UI:P means the victim must interact with attacker-controlled content. Real-world risk is therefore meaningful for targeted phishing or malicious advertisement scenarios against Samsung users, but low for opportunistic automated scanning. The absence of assigned CWE is a minor gap; affected version boundary (pre-6.3) is clearly stated by the vendor.

An attacker creates a malicious web page or SMS/email message containing a crafted custom URL scheme link targeting the My Galaxy handler. When the Samsung device user taps or visits the link, the My Galaxy app processes the request without validating the caller's authorization, returning or exposing sensitive user information accessible to the attacker-controlled page. No public proof-of-concept exploit code has been identified at time of analysis.