Samsung Assistant prior to version 9.3.10.7 improperly exports Android application components, allowing a local attacker to read data stored by the assistant. This results in a confidentiality breach of user information that should remain private.

The vulnerability affects Samsung Mobile’s Samsung Assistant on devices running any build earlier than 9.3.10.7. Versions 9.3.10.7 and later have corrected the component export handling, making the issue absent from those releases.

With a CVSS score of 4.8 the risk is considered low. The EPSS score of less than 1 % indicates that exploitation is unlikely. No remote attack vector is disclosed; the flaw is exploitable only by a local actor with physical or logical access to the device, for example a user in possession of the phone or a malicious app with user‑level permissions. There is no privilege escalation beyond the local context, and the vulnerability is not listed in CISA’s KEV catalog, further reducing immediate threat.