Improper input validation in Samsung Members allows a remote attacker to connect an arbitrary URL and launch an arbitrary activity within the app, using the app’s privileges. The vulnerability requires user interaction to trigger, but once triggered it could result in the execution of unintended functionality, potentially exposing sensitive data or allowing further exploitation within the device’s context. Based on the description, it is inferred that this flaw could represent privilege escalation or unauthorized code execution, which could compromise the integrity of the app’s environment.

The vulnerability affects Samsung Members for all devices running versions prior to 5.6.00.11 on Samsung Mobile. No specific model variants are listed, and the issue is identified only for Samsung Members applications installed before this patch level.

The CVSS score of 7 indicates a high severity, but the EPSS score of < 1% suggests that exploitation is unlikely under typical conditions. The vulnerability is not yet listed in CISA’s KEV catalog, implying that there is no confirmed widespread exploitation. Attackers would need to trick or convince a user to engage with a specially crafted link or application to trigger the flaw, making the likelihood reliant on social engineering.