Samsung Checkout EUVD-2026-97193

Requires local, on-device access: a separate malicious or malfunctioning app must be installed and running on the same Samsung device to invoke the exported/unprotected GuestCreditCardRegisterActivity component of Samsung Checkout. Exploitation is limited to Samsung Checkout versions prior to 5.1.03.1 and cannot be performed remotely or over a network; it depends on the vulnerable component being reachable by other apps. No authentication or user interaction is required (PR:N/UI:N), but the hard requirement for pre-existing local code execution on the device is the primary limiting factor, substantially narrowing realistic risk.

This is a medium-severity, locally-exploitable Android application flaw, not an urgent remote threat. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/PR:N/UI:N/VC:L/VI:L/VA:N) scores 5.1 and is internally consistent with the description: exploitation requires local access (a malicious or co-resident app on the same Samsung device), no privileges, and no user interaction, yielding only Low confidentiality and Low integrity impact with no availability impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or probable exploitation - this reads as a defense-in-depth hardening fix rather than a priority patch. The signals do not conflict: a local-only vector with limited impact and no exploitation evidence consistently points to low real-world risk. One caveat: the input provides only a CVSS 4.0 vector (no 3.1) and CWE is listed as N/A, so impact granularity is limited; the 'Information Disclosure' tag aligns with VC:L but the description's emphasis on 'launch an arbitrary activity' also implies an integrity/component-access issue (VI:L), which should be confirmed against the Samsung bulletin.

A malicious app already installed on the victim's Samsung device invokes the unprotected GuestCreditCardRegisterActivity in Samsung Checkout with crafted input, causing Samsung Checkout to launch an arbitrary activity under its own privileges. This could be abused to surface attacker-controlled UI or access components the calling app could not otherwise reach, potentially leaking limited information. No public exploit code was identified at time of analysis, and exploitation is confined to local, on-device access.