Samsung Internet CVE-2026-21132

Exploitation requires a victim running Samsung Internet prior to version 30.0.5.24 to visit or interact with attacker-controlled web content (UI:P passive user interaction) that supplies specially crafted input the browser fails to validate, enabling arbitrary script injection. The CVSS 4.0 AT:P metric indicates an additional attack precondition beyond attacker control must be present for the exploit to succeed. Limiting factors: no authentication is needed (PR:N) but user interaction is mandatory, the vulnerable version range is bounded (fixed in 30.0.5.24), impact is confined to confidentiality (no integrity or availability effect), and exposure is limited to the Samsung Internet browser context rather than the host OS or other applications.

This is a medium-severity (CVSS 4.0 base 6.0) script-injection flaw in the Samsung Internet browser, confirmed and reported by Samsung's own product security team (mobile.security@samsung.com). The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N) indicates a network-reachable, unauthenticated issue (PR:N) that nonetheless requires a present attack condition (AT:P) and passive user interaction (UI:P) to trigger, with impact limited to confidentiality (VC:H) and no integrity or availability effect. The combined need for an attack precondition and user interaction materially lowers real-world exploitability relative to the raw network vector. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a legitimate but not emergency priority - patch in normal mobile-update cadence rather than as a fire-drill. Note a data gap: CWE is listed as N/A despite the description clearly describing a script/code-injection (CWE-79/CWE-94 class) issue - classification should be verified against the Samsung advisory.

An attacker hosts or injects crafted web content that exploits improper input validation in Samsung Internet; when a victim using a version prior to 30.0.5.24 visits or interacts with that content, attacker-controlled script executes in the browser context and can exfiltrate session data or sensitive page information (VC:H). No public exploit code was identified in the provided data, and success depends on the required user interaction and the attack precondition indicated by AT:P.