Improper export of Android application components in the ExpressHomeWidgetReceiver of Samsung Assistant allows a local attacker to execute arbitrary scripts. The vulnerability does not specify remote exploitation or additional capabilities beyond running code under the app’s context.

Samsung Mobile devices that ship with Samsung Assistant versions earlier than 9.3.14 are affected. Updating the assistant application to version 9.3.14 or later removes the exposed component and mitigates the vulnerability.

The CVSS score of 6.9 indicates moderate severity while the EPSS score of less than 1% indicates a very low but nonzero exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector, as inferred from the description, is a local attacker who can place or trigger an arbitrary script on the device, such as via a malicious application or user action. Exploitation requires physical or logical access to the device and does not rely on remote network interaction.