Galaxy Store (Samsung) - vulnerabilities (CVEs)

31 CVEs, 0 in the last 30 days, 13 known versions, newest CVE from 2026-03-16. Vendor: Samsung.

CVEs of Galaxy Store

CVE-2026-21002 - CVSS 5.9 (medium), 2026-03-16: Improper verification of cryptographic signature in Galaxy Store prior to version 4.6.03.8 allows local attacker to install arbitrary application.
CVE-2026-21001 - CVSS 5.9 (medium), 2026-03-16: Path traversal in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege.
CVE-2026-21000 - CVSS 7 (high), 2026-03-16: Improper access control in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege.
CVE-2026-20976 - CVSS 7.8 (high), 2026-01-09: Improper input validation in Galaxy Store prior to version 4.6.02 allows local attacker to execute arbitrary script.
CVE-2025-58483 - CVSS 5.9 (medium), 2025-12-02: Improper export of android application components in Galaxy Store for Galaxy Watch prior to version 1.0.06.29 allows local attacker to install arbitrary…
CVE-2023-21483 - CVSS 6.4 (medium), 2025-09-03: Improper Access Control vulnerability in Galaxy Store prior to version 4.5.53.6 allows local attacker to access protected data using exported service.
CVE-2025-20951 - CVSS 5.5 (medium), 2025-04-08: Improper verification of intent by broadcast receiver vulnerability in Galaxy Store prior to version 4.5.90.7 allows local attackers to write arbitrary files…
CVE-2025-20895 - CVSS 4.6 (medium), 2025-02-04: Authentication Bypass Using an Alternate Path in Galaxy Store prior to version 4.5.87.6 allows physical attackers to install arbitrary applications to bypass…
CVE-2024-34601 - CVSS 5.9 (medium), 2024-07-02: Improper verification of intent by broadcast receiver vulnerability in GalaxyStore prior to version 4.5.81.0 allows local attackers to launch unexported…
CVE-2024-20870 - CVSS 5.5 (medium), 2024-05-07: Improper verification of intent by broadcast receiver vulnerability in Galaxy Store prior to version 4.5.71.8 allows local attackers to write arbitrary files…
CVE-2024-20825 - CVSS 5.5 (medium), 2024-02-06: Implicit intent hijacking vulnerability in IAP of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via implicit…
CVE-2024-20824 - CVSS 5.5 (medium), 2024-02-06: Implicit intent hijacking vulnerability in VoiceSearch of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via…
CVE-2024-20823 - CVSS 5.5 (medium), 2024-02-06: Implicit intent hijacking vulnerability in SamsungAccount of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via…
CVE-2024-20822 - CVSS 5.5 (medium), 2024-02-06: Implicit intent hijacking vulnerability in AccountActivity of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information…
CVE-2023-42581 - CVSS 7.5 (high), 2023-12-05: Improper URL validation from InstantPlay deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to access data.
CVE-2023-42580 - CVSS 9.8 (critical), 2023-12-05: Improper URL validation from MCSLaunch deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to install APK from…
CVE-2023-30705 - CVSS 6.8 (medium), 2023-08-10: Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.56.6?allows local attackers to access privileged content providers as Galaxy…
CVE-2023-21514 - CVSS 8.8 (high), 2023-05-26: Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from…
CVE-2023-21516 - CVSS 9.6 (critical), 2023-05-26: XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.
CVE-2023-21515 - CVSS 8.8 (high), 2023-05-26: InstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript…
CVE-2023-21434 - CVSS 6.2 (medium), 2023-02-09: Improper input validation vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to execute JavaScript by launching a web page.
CVE-2023-21433 - CVSS 7.8 (high), 2023-02-09: Improper access control vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to install applications from Galaxy Store.
CVE-2022-33709 - CVSS 7.8 (high), 2022-07-12: Improper input validation vulnerability in ApexPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as…
CVE-2022-33708 - CVSS 7.8 (high), 2022-07-12: Improper input validation vulnerability in AppsPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as…
CVE-2022-33710 - CVSS 7.8 (high), 2022-07-12: Improper input validation vulnerability in BillingPackageInsraller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as…
CVE-2022-28791 - CVSS 6.2 (medium), 2022-05-03: Improper input validation vulnerability in InstallAgent in Galaxy Store prior to version 4.5.41.8 allows attacker to overwrite files stored in a specific…
CVE-2022-28776 - CVSS 7.8 (high), 2022-04-11: Improper access control vulnerability in Galaxy Store prior to version 4.5.36.4 allows attacker to install applications from Galaxy Store without user…
CVE-2022-28544 - CVSS 6.2 (medium), 2022-04-11: Path traversal vulnerability in unzip method of InstallAgentCommonHelper in Galaxy store prior to version 4.5.40.5 allows attacker to access the file of…
CVE-2022-28542 - CVSS 6.8 (medium), 2022-04-11: Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.40.5 allows local attackers to access privileged content providers as Galaxy…
CVE-2022-22288 - CVSS 7.5 (high), 2022-01-10: Improper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist.
CVE-2021-25499 - CVSS 7.1 (high), 2021-10-06: Intent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to version 4.5.32.4 allows attacker to access content provider of…