Samsung Checkout CVE-2026-21128

Requires local code execution on the device via a malicious or compromised app that can invoke Samsung Checkout's CreditCardRegisterActivity component; the specific prerequisite is that this activity performs improper input validation allowing it to be driven to launch an arbitrary activity with Samsung Checkout privileges. Exploitation is limited to Samsung Checkout versions prior to 5.1.03.1 and to the local device context - there is no remote vector (AV:L), so an attacker must first get code running on the device, though no additional authentication or user interaction is needed (PR:N/UI:N).

This is a medium-severity, locally-exploitable flaw whose signals are internally consistent and point to limited real-world urgency. The only CVSS vector provided is a CVSS 4.0 base vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N, scoring 5.1), which indicates local attack vector, low complexity, no privileges and no user interaction required, with only low confidentiality and low integrity impact and no availability impact. The local attack vector (AV:L) is the dominant mitigating factor: exploitation requires an attacker to already be executing code on the device (e.g., a malicious app), not a remote network attacker. There is no KEV listing, no EPSS score, and no POC provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC data is provided. Note a signal to verify: the input Tags label this 'Information Disclosure,' but the description describes launching an arbitrary activity with Samsung Checkout's privileges - a component-permission/confused-deputy issue - which only partially aligns with pure information disclosure; the VC:L/VI:L impacts are modest and consistent with limited exposure rather than full compromise. Overall this is a genuine but low-priority local privilege/component-access issue, not a high-urgency remote threat.

A malicious or compromised application already installed on a Samsung device invokes the improperly-validated CreditCardRegisterActivity in Samsung Checkout, passing crafted input that causes it to launch an arbitrary activity under Samsung Checkout's privileges. Because the flaw is local and low-complexity (AV:L/AC:L) and needs no special privileges or user interaction (PR:N/UI:N), any sideloaded or trojanized app could attempt it. No public exploit code was identified at time of analysis.