CVE-2023-21516

XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.

Score

CVSS 3.1 9.6 Critical

Status

Modified - mobile.security@samsung.com

Published

2023-05-26

Last modified

2025-01-15

Weaknesses

CWE-20, CWE-79

Affected products

• Galaxy Store (Samsung)
• Galaxy Store (Samsung Mobile)

References

• https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01