My Galaxy
Monthly
Improper authorization in the custom URL scheme handler of Samsung's My Galaxy app (all versions prior to 6.3) exposes sensitive information to remote attackers. The flaw exists because the handler processes inbound custom URL scheme invocations without enforcing adequate authorization checks, enabling an attacker-controlled web page or application to silently extract user data when a victim interacts with a crafted link. No public exploit code has been identified at time of analysis, and CISA KEV does not list this as actively exploited, but the zero-privilege requirement from the attacker's side and the broad Samsung device install base make timely patching advisable.
Improper authorization in the custom URL scheme handler of Samsung's My Galaxy app (all versions prior to 6.3) exposes sensitive information to remote attackers. The flaw exists because the handler processes inbound custom URL scheme invocations without enforcing adequate authorization checks, enabling an attacker-controlled web page or application to silently extract user data when a victim interacts with a crafted link. No public exploit code has been identified at time of analysis, and CISA KEV does not list this as actively exploited, but the zero-privilege requirement from the attacker's side and the broad Samsung device install base make timely patching advisable.