EUVD-2026-55106
GHSA-425r-57mx-xgj9
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with low-privilege co-resident app, user interaction required to trigger the exported component, and high confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (SamsungMobile).
CVSS VectorVendor: SamsungMobile
Lifecycle Timeline
1DescriptionCVE.org
Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability.
AnalysisAI
SamsungPassAutofill prior to version 5.2.10.x on Samsung Android devices improperly exports application components, enabling a locally-installed malicious app to access sensitive autofill credential data with user interaction. The CVSS 4.0 vector (AV:L/PR:L/UI:A/VC:H) confirms the attack is constrained to on-device, low-privilege access requiring user-triggered activity, yielding a moderate score of 5.1 despite high confidentiality impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a malicious application to be installed on the same Samsung Android device running a vulnerable version of SamsungPassAutofill (prior to 5.2.10.x). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N captures the core risk profile: local-only attack, low attacker privilege (a co-resident app), mandatory user interaction, and high confidentiality impact confined to the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update SamsungPassAutofill to version 5.2.10.x or later, delivered via Samsung's monthly security update or through the Galaxy Store. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today