Improper input validation in the CreditCardRetrieveActivity of Samsung Checkout allows a local attacker to launch an arbitrary activity using the application's privileges. This flaw effectively lets a malicious app or component invoke privileged Samsung Checkout actions, potentially exposing sensitive information or performing unauthorized operations. The impact is a local privilege escalation within the Samsung Checkout application, giving the attacker control over actions normally restricted to the app's own environment.

This vulnerability affects Samsung Checkout by Samsung Mobile. Versions prior to 5.1.03.1 are impacted, while any build on or after that release addresses the flaw. Devices running the affected application cannot rely on the security of its activity handling.

The CVSS base score of 5.1 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting no widely known exploitation yet. The attack vector is local: a user must have physical or trusted local access to the device to trigger the malicious intent. Although the vulnerability provides a path for privilege escalation, the lack of remote delivery and the requirement for intimate app knowledge limit the likelihood of widespread exploitation. Nonetheless, the exposure remains significant for environments where the application handles payment data.