Improper export of Android application components in Samsung Account before version 15.7.01.1 allows a local attacker to read or manipulate sensitive information stored by the application. The vulnerability is limited to the device and does not enable remote code execution, but it can expose private data that the account is responsible for, thereby compromising confidentiality.

Samsung Mobile devices running the Samsung Account application with versions earlier than 15.7.01.1 are affected. The vulnerable component(s) are exported unintentionally, permitting other applications on the same device to interact with them.

The CVSS score of 6.9 indicates a moderate impact. The EPSS score is under 1%, suggesting a very low but non‑zero probability of exploitation, and the issue is not listed in the CISA KEV catalog, so the exploitation probability remains uncertain but low. Attackers would need local access to the device and the ability to install or use a malicious application that can target the exported components. Once accessed, sensitive data could be read or altered.