Improper access control in Samsung Internet prior to 30.0.5.6 enables an attacker who can access the device locally to read sensitive information. The flaw originates from a privilege‑mismanagement weakness classified as a CWE‑284 Access Control Failure. A successful exploit would allow the attacker to compromise confidentiality by bypassing intended data access restrictions.

Samsung Internet on Samsung Mobile devices running a version earlier than 30.0.5.6 is affected. The vulnerability is present in all builds before this patch release.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score is currently unavailable. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local, meaning that an attacker must have physical or local software access to the device. If present, the flaw could be leveraged by privileged local applications or users with sufficient device access to obtain privileged data.