Samsung Assistant EUVD-2026-34805

Q: What is the CVSS score of EUVD-2026-34805?

EUVD-2026-34805 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-21033 MEDIUM

2026-06-05 SamsungMobile

GHSA-24v9-59pc-wmrv

Information Disclosure Google Samsung Samsung Assistant Samsung Mobile

6.9

CVSS 4.0 · Vendor: SamsungMobile

Severity by source

Vendor (SamsungMobile) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (SamsungMobile) · only source for this CVE.

CVSS VectorVendor: SamsungMobile

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 13:37 vuln.today

CVSS changed

Jun 05, 2026 - 11:22 NVD

6.9 (MEDIUM)

CVE Published

Jun 05, 2026 - 10:15 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 10:15 nvd

MEDIUM 6.9

DescriptionCVE.org

Improper export of android application components in ExpressHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script.

AnalysisAI

Improper export of the ExpressHomeWidgetReceiver Android component in Samsung Assistant (prior to version 9.3.14) enables a local attacker without special privileges to send crafted intents to the exposed receiver and execute arbitrary scripts on the device. The CVSS 4.0 score of 6.9 reflects high confidentiality impact (VC:H) with a local attack vector - an on-device malicious application is a realistic threat model. No public exploit has been identified and this CVE does not appear in CISA KEV at time of analysis.

Technical ContextAI

Samsung Assistant is a Samsung-developed AI assistant application for Android devices, identified by CPE cpe:2.3:a:samsung_mobile:samsung_assistant:*:*:*:*:*:*:*:*. The vulnerability resides in ExpressHomeWidgetReceiver, an Android BroadcastReceiver component. In Android, application components such as BroadcastReceivers can be declared as exported in the AndroidManifest.xml, making them reachable by other applications on the same device. When exported without enforcing custom permissions or intent filters with adequate restrictions, any local application can send arbitrary intents to the component. This class of vulnerability is characteristic of improper Android component export patterns - conceptually aligned with CWE-926 (Improper Export of Android Application Components) - though no formal CWE is assigned to this CVE. The 'Google' tag in the source intelligence likely reflects the Android platform context rather than a distinct Google product being affected.

RemediationAI

The primary fix is to update Samsung Assistant to version 9.3.14 or later, as confirmed by the Samsung Mobile Security June 2026 advisory at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=06. Updates are typically delivered via the Galaxy Store or Samsung Software Update mechanism on affected devices. As a compensating control on devices that cannot be immediately updated, administrators managing enterprise Android fleets via MDM should enforce app allowlisting policies to prevent untrusted third-party applications from being installed - this directly removes the threat actor's necessary foothold, since exploitation requires a malicious app running locally on the device. Restricting sideloading (disabling 'Install unknown apps' in Android settings) reduces the attack surface further, though it does not eliminate risk from apps distributed via the Play Store. Note that these compensating controls impose usability restrictions and do not address the underlying component export flaw.