This vulnerability (CWE-926) in SamsungPassAutofill versions before 5.2.10 arises from improper export of Android application components. This misconfiguration enables local attackers with limited privileges to access sensitive information stored or managed by the application. The attack vector requires user interaction, reducing the likelihood of automated exploitation. The CVSS 4.0 base score is 5.1, reflecting a medium impact primarily due to local attack complexity and required user involvement. No vendor advisory or patch information is currently available to confirm remediation status.

Local attackers with limited privileges can access sensitive information within SamsungPassAutofill due to improperly exported components. The requirement for user interaction limits the ease of exploitation. There is no indication of remote exploitation or privilege escalation. The vulnerability does not affect cloud services and no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious about granting permissions and interacting with untrusted content related to SamsungPassAutofill. Monitor official Samsung Mobile communications for updates.