CVE-2026-21130: CWE-20: Improper Input Validation in Samsung Mobile Samsung Checkout

This vulnerability involves improper input validation in the CreditCardRetrieveActivity of Samsung Checkout before version 5.1.03.1. It enables local attackers to exploit this flaw to launch arbitrary activities under the privileges of Samsung Checkout. The CVSS 4.0 vector indicates the attack requires local access with low complexity and no user interaction, but with low confidentiality and integrity impact. No known exploits are reported in the wild, and no vendor advisory or patch information is provided.

Successful exploitation allows a local attacker to launch arbitrary activities with Samsung Checkout privileges, which may lead to unauthorized operations within the app. The impact is limited to local attackers and has low confidentiality and integrity impact according to the CVSS vector. There is no indication of remote exploitation or privilege escalation beyond the app's context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users and administrators should monitor Samsung's official channels for updates. Until a fix is available, restricting local access to trusted users and devices may reduce risk.