Pair of Galaxy App Store Bugs Offer Cyberattackers Mobile Device Access
Devices running Android 12 and below are at risk of attackers downloading apps that direct users to a malicious domain.
![Phone software update screen Phone software update screen](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt3b2f772614f2ff43/64f1540bddf01710fa5d6c3a/device_update_Yuen_Man_Cheung_Alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
The Galaxy App Store, the official mobile app store available on Samsung devices, has two vulnerabilities, which, if exploited, could allow threat actors to install a malicious application without the user ever knowing it's taken place.
The issue only affects devices with Android 12 and lower, according to an analysis from NCC Group.
The first vulnerability, tracked as CVE-2023-21433, lets attackers install applications from the Galaxy App Store. The second, tracked as CVE-2023-21434, could let attackers launch a Web domain they control and execute JavaScript, the NCC Group report on the bugs explained.
"Samsung has released an updated version of the Galaxy App Store (version 4.5.49.8)," NCC Group's Ken Gannon said. "Users should open the Galaxy App Store on their phone, and, if prompted, download and install the latest version."
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024