Samsung Internet EUVD-2026-97199

Requires local access to the device running Samsung Internet prior to version 30.0.5.6 (AV:L) - remote exploitation is not possible. The AT:P metric means a specific attack requirement must hold (for example a particular app or timing state) rather than succeeding against every default invocation, which limits reliability. Once that condition is met, no authentication/privileges (PR:N) and no user interaction (UI:N) are needed. Impact is limited to disclosure of sensitive information (VC:H) with no integrity or availability effect, and updating to 30.0.5.6 or later removes the flaw.

This is a medium-severity (CVSS 4.0 base 5.9) local information-disclosure flaw and should be treated as a moderate, not urgent, priority. The CVSS 4.0 vector tells a coherent story: AV:L means the attacker needs local access to the device (not remote/network), AT:P indicates a specific attack requirement or precondition must be met, PR:N/UI:N mean no privileges or user interaction are needed once that condition exists, and VC:H/VI:N/VA:N confine the impact to confidentiality only (sensitive-information read) with no integrity or availability loss. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no POC was referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of a local-only vector, an added attack requirement (AT:P), and confidentiality-only impact meaningfully lowers real-world risk versus the raw score: this is a realistic low-to-moderate priority rather than a high-urgency item, despite Samsung Internet's large install base. Note that the CWE is listed as N/A and no EPSS/SSVC data was provided, so automatable/technical-impact framing cannot be independently derived from the input.

An attacker with local access to an unlocked or shared Samsung device (or a malicious co-resident app) leverages improper access control in Samsung Internet below 30.0.5.6 to read sensitive browser-held information such as cached data, credentials, or browsing artifacts that should be access-restricted. The AT:P requirement implies a specific precondition (e.g. a timing/race window or particular app state) must be satisfied, but no user interaction or elevated privileges are needed once it is. No public exploit code is known for this CVE at time of analysis.