Headline
Pair of Galaxy App Store Bugs Offer Cyberattackers Mobile Device Access
Devices running Android 12 and below are at risk of attackers downloading apps that direct users to a malicious domain.
The Galaxy App Store, the official mobile app store available on Samsung devices, has two vulnerabilities, which, if exploited, could allow threat actors to install a malicious application without the user ever knowing it’s taken place.
The issue only affects devices with Android 12 and lower, according to an analysis from NCC Group.
The first vulnerability, tracked as CVE-2023-21433, lets attackers install applications from the Galaxy App Store. The second, tracked as CVE-2023-21434, could let attackers launch a Web domain they control and execute JavaScript, the NCC Group report on the bugs explained.
“Samsung has released an updated version of the Galaxy App Store (version 4.5.49.8),” NCC Group’s Ken Gannon said. “Users should open the Galaxy App Store on their phone, and, if prompted, download and install the latest version.”
Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
Subscribe
Related news
Improper input validation vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to execute JavaScript by launching a web page.
Two security flaws have been disclosed in Samsung's Galaxy Store app for Android that could be exploited by a local attacker to stealthily install arbitrary apps or direct prospective victims to fraudulent landing pages on the web. The issues, tracked as CVE-2023-21433 and CVE-2023-21434, were discovered by NCC Group and notified to the South Korean chaebol in November and December 2022. Samsung
Two security flaws have been disclosed in Samsung's Galaxy Store app for Android that could be exploited by a local attacker to stealthily install arbitrary apps or direct prospective victims to fraudulent landing pages on the web. The issues, tracked as CVE-2023-21433 and CVE-2023-21434, were discovered by NCC Group and notified to the South Korean chaebol in November and December 2022. Samsung