CVE-2023-42580

Improper URL validation from MCSLaunch deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to install APK from Galaxy Store.

Score

CVSS 3.1 9.8 Critical

Status

Modified - mobile.security@samsung.com

Published

2023-12-05

Last modified

2024-08-02

Affected products

• Galaxy Store (Samsung)
• Galaxy Store (Samsung Mobile)

References

• https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=12