CVE-2026-21130

5.1Medium

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

5.1Medium

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-20

Impact

A local attacker can launch arbitrary application activities with Samsung Checkout privileges. They need local code execution on the device first.

Root cause

Improper input validation in the CreditCardRetrieveActivity component allows unauthorized intent redirection.

Affected systems

Samsung Checkout prior to version 5.1.03.1

CVSS v4.0 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Update the Samsung Checkout app to version 5.1.03.1 or later via the Galaxy Store. No interim workarounds are documented.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.

References

https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=10

Source: nvd.nist.gov/vuln/detail/CVE-2026-21130