The flaw arises from inadequate validation of user input in the GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1, permitting a local attacker to launch any Android activity that operates with the same privileges as the payment app. This enables execution of arbitrary code within the app’s privileged context, potentially exposing payment details or allowing further local compromise. The CVSS score of 5.1 indicates a moderate severity, but the consequence of bypassing input checks is significant for confidential information.

Samsung Mobile users running Samsung Checkout before the 5.1.03.1 release are affected. No additional internal version identifiers are specified; any installation predating 5.1.03.1 may be vulnerable, whereas the patched 5.1.03.1 and later releases contain the fix.

EPSS data is unavailable and the issue is not listed in the CISA KEV catalog. The attack vector is local, requiring an adversary to have direct or physical access to the device. The moderate CVSS rating reflects the limited scope and local requirement, yet the ability to initiate privileged activities could serve as a stepping‑stone for further local exploitation. No public exploits have been documented at this time.