Technical impact
Samsung Internet implements an authorization check that incorrectly grants local users access to protected data. The flaw allows a local attacker to read sensitive information that should be restricted, exposing personal or proprietary data and potentially enabling further attacks against the device. This is an example of Improper Access Control (CWE-284).
Affected Systems
Samsung Internet browser on Samsung Mobile, all versions prior to 30.0.0.39, is affected. Users running any older build are at risk; updating to 30.0.0.39 or later removes the vulnerability.
Risk and Exploitability
The CVSS score of 6.3 indicates moderate severity. The vulnerability is exploitable only by local attackers who can act on the device, so the attack vector is local. The EPSS score is 0.00094, and the flaw is not listed in the CISA KEV catalog. Despite the limited reach, the potential for sensitive data exposure makes the risk noteworthy for environments where local access is not strictly controlled.
