EUVD-2026-97194
GHSA-9cg5-h2c5-4388
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on device
-
DeliveryCraft intent to CreditCardRetrieveActivity
-
ExploitBypass improper input validation
-
ExecutionLaunch arbitrary activity as Samsung Checkout
-
ImpactDisclose payment-related information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires a locally installed malicious application on a Samsung device running Samsung Checkout prior to version 5.1.03.1; the attacker's app must send input to the exported/accessible CreditCardRetrieveActivity component to abuse the improper input validation and launch an arbitrary activity with Samsung Checkout privileges. Limiting factors: there is no remote vector (AV:L) - the attacker must already have code execution on the device (typically via a sideloaded or malicious app the user installed), and impact is limited to low-severity information disclosure and integrity effects (VC:L/VI:L, no availability impact). Devices updated to 5.1.03.1 or later are not affected. |
| Impact | This is a genuinely medium/low-priority issue, not a high-severity emergency. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N) scores 5.1 and is internally consistent: exploitation requires LOCAL access, meaning a malicious application already present on the same Samsung device, and yields only LOW confidentiality and LOW integrity impact with no availability impact. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public exploit (POC) was supplied - so the status is no public exploit identified at time of analysis. The 'local attackers' phrasing in the description aligns with the AV:L in the CVSS vector, so the signals are consistent rather than conflicting. The main caveat is that PR:N here means 'no privileges beyond the ability to run code locally' (i.e., a rogue app), which should not be mistaken for remote unauthenticated reach. CWE is listed as N/A and no EPSS/CWE enrichment is available, so impact granularity is inferred from the CVSS vector and the 'Information Disclosure' tag rather than independently confirmed. |
| Exploit ScenarioDerived | A user is tricked into installing a malicious or trojanized app on their Samsung device. Because CreditCardRetrieveActivity improperly validates its input, the rogue app invokes it to launch an arbitrary activity that then runs with Samsung Checkout's elevated privileges, potentially exposing payment-related information (Information Disclosure). No public exploit code was identified at time of analysis, and the local-only vector with low complexity means no user interaction beyond initial app installation is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Improper input validation in the CreditCardRetrieveActivity component of Samsung Checkout prior to version 5.1.03.1 allows a locally installed malicious application to launch arbitrary activities with Samsung Checkout's own privileges, resulting in low-severity information disclosure and integrity impact. Exploitation is not remote: the attacker must already have code executing on the device, typically through a sideloaded or otherwise installed malicious app, and must be able to pass crafted input to the affected activity. There is no confirmed active exploitation and no public exploit code identified at time of analysis, and Samsung has shipped a fixed build (5.1.03.1) as documented in its mobile security bulletin.
RemediationAI
Upgrade Samsung Checkout to version 5.1.03.1 or later - the vendor-released patch - via the Galaxy Store or the device's built-in update mechanism, and verify the installed version in Settings; devices on 5.1.03.1+ are not affected. Because there is no remote vector and the entry condition is a malicious co-resident app, the most effective compensating control is to prevent untrusted code from being installed in the first place: keep 'Install unknown apps'/sideloading disabled per source, enforce Google Play Protect or Samsung's equivalent device scanning, and remove untrusted sideloaded applications. Restricting the exported activity or the Samsung Checkout package itself is not generally available to end users and would break checkout/payment functionality, so it is not a practical mitigation. On managed fleets, EMM/MDM allow-listing of installable packages reduces exposure with the trade-off of administrative overhead and occasional blocking of legitimate apps; no user-visible toggle exists to disable only CreditCardRetrieveActivity, meaning patching remains the only clean fix. If patching is delayed, treat the residual risk as low given the local-only vector, low confidentiality/integrity impact, and absence of known exploit code.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Samsung Checkout is a pre-installed Android payment/checkout service that exposes an Activity component, CreditCardRetrieveActivity, to other applications on the device. The root-cause class is improper input validation (CWE-20): the component processes externally supplied Intent data without adequately validating it, so a co-resident app can drive the activity into states or flows it should not reach and thereby launch arbitrary activities under Samsung Checkout's application identity and permissions. This is a classic Android component-exposure/intent-abuse pattern rather than a memory-safety or network-protocol flaw. The published CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N) reflects a local attack with no privileges or user interaction required, limited confidentiality and integrity impact, and no availability impact; the independent assessment maps this to CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, which is consistent. Because the vector contains PR:N but AV:L, the exploit is unauthenticated in privilege terms yet still requires the attacker to already have local code execution on the target device. All affected builds are fixed in 5.1.03.1.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
A co-located malicious app (no special privileges) invokes the vulnerable activity locally with low complexity, giving AV:L/PR:N and limited low confidentiality/integrity impact, no availability.
Primary rating from Vendor (samsung).
CVSS VectorVendor: samsung
DescriptionCVE.org
Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB