CVE-2026-21129
5.1MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-20
Impact
A local attacker can launch arbitrary application activities with Samsung Checkout permissions. They need local execution capabilities on the device to send malicious intents.
Root cause
Improper input validation in the GuestCreditCardRegisterActivity component allows unsafe intent redirection.
Affected systems
Samsung Checkout versions prior to 5.1.03.1
CVSS v4.0 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade Samsung Checkout to version 5.1.03.1 or higher via the Galaxy Store. No interim workaround or configuration mitigation is documented.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.