Samsung Escargot CVE-2026-47311

Exploitation requires the victim to execute attacker-controlled JavaScript inside an Escargot-backed runtime (UI:R in the CVSS vector), with no authentication to the engine itself (PR:N) and local attack vector (AV:L) meaning the JS must reach the engine on the device - typically via a malicious web page rendered in an Escargot-powered web view, a sideloaded or malicious app on a Tizen/IoT device, or attacker-supplied script content in any product that embeds Escargot as its JS interpreter. Specific code paths require either a TypedArray.copyWithin call whose argument coercion resizes the underlying buffer such that len - startIndex or len - targetIndex becomes negative, or array-spread expressions that cause setArrayLength to push the array beyond fast-mode thresholds mid-operation, or a nested eval throw combined with a finally-block allocation that invalidates the error value. Limiting factors: the engine must actually execute untrusted JS (devices that only run signed first-party scripts are not exposed), the targeted build must predate the PR #1565 merge, and the user must take an action that loads the malicious content.

Real-world risk is moderate-to-high in embedded contexts but constrained by the attack surface. CVSS 7.8 with AV:L/AC:L/PR:N/UI:R indicates local vector with user interaction - for a JavaScript engine this typically maps to 'victim runs attacker-supplied JS,' which on smart TVs, wearables, or IoT apps may still be reachable via a web view, sideloaded app, or malicious content. SSVC signals are not provided, but technical impact is total (C:H/I:H/A:H), and the corruption classes shown in the patch (integer underflow into size_t, fast-mode invariant violation) are historically reliable primitives for type confusion and arbitrary read/write in JS engines. Exploitation status: no public exploit identified at time of analysis; not in CISA KEV; EPSS not provided. The CVSS vector marks AV:L while the description simply says 'allows Overflow Buffers' - defenders embedding Escargot in network-reachable scriptable surfaces should treat the practical reachability as potentially higher than AV:L implies and verify with vendor; conversely, devices that never execute untrusted JS face minimal exposure.

An attacker hosts a malicious web page or crafts a malicious application bundle containing JavaScript that calls TypedArray.copyWithin with arguments that trigger a buffer resize during coercion (forcing len - startIndex to go negative), or that uses array spread to provoke a fast-mode downgrade mid-operation; when a victim opens the page in an Escargot-backed web view on a smart TV or IoT device, the engine writes past the heap allocation and corrupts adjacent objects. No public exploit identified at time of analysis, but the patch diff alone provides a clear roadmap for a competent JS-engine exploit developer to weaponize the primitives toward arbitrary code execution within the engine's process.