EUVD-2026-55100
GHSA-grg8-xhr3-987r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable handler exploitable without attacker privileges, but requires victim to interact with a crafted link; only limited confidentiality impact, no integrity or availability effect.
Primary rating from Vendor (SamsungMobile).
CVSS VectorVendor: SamsungMobile
Lifecycle Timeline
1DescriptionCVE.org
Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information.
AnalysisAI
Improper authorization in the custom URL scheme handler of Samsung's My Galaxy app (all versions prior to 6.3) exposes sensitive information to remote attackers. The flaw exists because the handler processes inbound custom URL scheme invocations without enforcing adequate authorization checks, enabling an attacker-controlled web page or application to silently extract user data when a victim interacts with a crafted link. No public exploit code has been identified at time of analysis, and CISA KEV does not list this as actively exploited, but the zero-privilege requirement from the attacker's side and the broad Samsung device install base make timely patching advisable.
Technical ContextAI
Custom URL schemes (also called deep links) allow mobile applications to register a URI protocol handler - for example 'mygalaxy://' - so that external sources such as web browsers, SMS messages, or other apps can invoke specific in-app functionality. Proper authorization in such handlers requires that the app validate the caller's identity or intent before acting on the request or returning data. In My Galaxy prior to version 6.3, this validation is absent or insufficient, meaning any remote party that can induce user interaction with a crafted URL can invoke the handler and receive sensitive information in the response. The affected product is identified by CPE cpe:2.3:a:samsung_mobile:my_galaxy:*:*:*:*:*:*:*:* - a Samsung-exclusive companion application distributed on Galaxy devices. CWE classification was not assigned by the reporter, but the root cause is consistent with CWE-939 (Improper Authorization in Handler for Custom URL Scheme) or CWE-285 (Improper Authorization).
RemediationAI
Update My Galaxy to version 6.3 or later, which contains the authorization fix for the custom URL scheme handler. The patch is confirmed by Samsung Mobile via the August 2026 Samsung Mobile Security Bulletin at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=08. Users should update through the Galaxy Store or system update mechanism on their Samsung device. As a compensating control prior to patching, users can avoid opening links from untrusted sources in browsers or messaging applications on affected devices, which reduces the likelihood of inadvertently triggering the vulnerable URL scheme handler. No configuration toggle to disable the custom URL scheme is documented in available data.
More in Samsung Mobile
View allLibQJpeg in the Samsung Galaxy S6 before the October 2015 MR allows remote attackers to cause a denial of service (memor
Out-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Race condition in the ioctl implementation in the Samsung Graphics 2D driver (aka /dev/fimg2d) in Samsung devices with A
The kbase_dispatch function in arm/t7xx/r5p0/mali_kbase_core_linux.c in the GPU driver on Samsung devices with M(6.0) an
Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
On Samsung mobile devices with M(6.0) and N(7.x) software, a heap overflow in the sensorhub binder service leads to code
On Samsung mobile devices with N(7.x) software, a buffer overflow in the vision service allows code execution in a privi
Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). Rated medium s
Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). Rated medium s
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today