CVE-2026-21132
6.0MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
- Impact
- High impact on confidentiality
- Weakness
- —
Impact
Remote attackers can execute arbitrary scripts and access confidential data in the user's browser context. An attacker must first convince the user to interact with a malicious link or page.
Root cause
Improper input validation allows unsanitized content to trigger arbitrary script injection.
Affected systems
Samsung Internet prior to version 30.0.5.24
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade Samsung Internet to version 30.0.5.24 or later via the Galaxy Store or Google Play Store. If updates cannot be applied immediately, advise users to switch to an alternate browser.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering this vulnerability.