Samsung Print Service Plugin CVE-2026-3291

Q: What is the CVSS score of CVE-2026-3291?

CVE-2026-3291 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Export of Android Application Components (CWE-926)

2026-05-06 hp-security-alert@hp.com

Information Disclosure Google Samsung HP Samsung Print Service Plugin

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.2 MEDIUM

Local attack via co-resident app (AV:L), no attacker privileges required, confidentiality-only impact with no integrity or availability effect.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:11 vuln.today

CVE Published

May 06, 2026 - 22:16 nvd

MEDIUM 6.9

DescriptionCVE.org

Samsung Print Service Plugin for Android is potentially vulnerable to information disclosure when using an outdated version of the application via mobile devices. HP is releasing updates to mitigate these potential vulnerabilities.

AnalysisAI

Information disclosure in HP's Samsung Print Service Plugin for Android exposes high-confidentiality data to other local applications on the same device when an outdated version of the plugin is installed. CWE-926 (Improper Export of Android Application Components) indicates the root cause is improperly exported app components, allowing co-resident Android apps to access sensitive data without declared permissions. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.01% at the 3rd percentile, and SSVC rates exploitation as none with non-automatable impact, making this a low-urgency but valid privacy concern requiring an application update.

Technical ContextAI

Samsung Print Service Plugin (CPE: cpe:2.3:a:hp:samsung_print_service_plugin:*:*:*:*:*:android:*) is an HP-distributed Android application enabling printing from Android devices to HP and Samsung printers. CWE-926 (Improper Export of Android Application Components) describes a class of Android-specific vulnerabilities where components such as Activities, Services, BroadcastReceivers, or ContentProviders are declared with android:exported=true - or implicitly exported via intent filters - without enforcing permission checks. This allows any installed application on the same device to interact with those components and potentially extract data the plugin handles (e.g., documents, print jobs, network credentials, or device identifiers). The attack vector is strictly local (AV:L in both CVSS 3.x and 4.0), meaning exploitation requires a co-resident malicious application rather than a network-based attacker.

RemediationAI

Update the Samsung Print Service Plugin to the latest available version via the Google Play Store or your mobile device management (MDM) platform. HP has released updates addressing this vulnerability per advisory HPSBGN04093 at https://support.hp.com/us-en/document/ish_14864662-14864690-16/hpsbgn04093. An exact patched version number is not independently confirmed from the available input data - consult the HP advisory directly for the minimum safe version. As a compensating control while awaiting updates, restrict device app installation to trusted sources only and disable sideloading (unknown sources) to prevent co-resident malicious apps that could exploit the exported component. Organizations managing Android fleets via MDM should enforce automatic app updates for the plugin and audit which apps are co-installed on devices that handle sensitive print content.