An attacker can trigger this flaw by delivering malicious content to a user, which is then interpreted as executable script by Samsung Internet. The vulnerability arises from insufficient input validation prior to version 30.0.5.24, allowing the injection of arbitrary code. Exploit of the flaw could let an attacker steal credentials or perform actions on the user’s behalf within the context of the browsing session.

Samsung Internet browsers running before version 30.0.5.24 on Samsung Mobile devices are impacted. No other vendors or products are listed as affected.

The flaw has a CVSS score of 6, indicating a medium severity impact. The EPSS score is not available, and it is not currently listed in the CISA KEV catalog, suggesting it has not yet been actively exploited. Because user interaction is required, a woman attacker would need to get a victim to visit or open malicious web content. Once triggered, the attacker could execute arbitrary JavaScript in the context of the browser.