CVE-2026-21128
5.1MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-20
Impact
Local attackers can launch arbitrary app components with Samsung Checkout privileges. They require local access on the device to send intents to the vulnerable activity.
Root cause
CreditCardRegisterActivity fails to properly validate inputs before launching internal application activities.
Affected systems
Samsung Checkout prior to version 5.1.03.1
CVSS v4.0 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Update Samsung Checkout to version 5.1.03.1 or later via the Galaxy Store. No interim workaround is available; update the application directly.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbitrary activity with Samsung Checkout privileges.