CVE-2024-34636

Vulnerability

Samsung Email versions prior to 6.1.94.2 contain a vulnerability where the application uses an implicit intent for sensitive communication. An implicit intent does not specify a target component, allowing any application on the device to intercept the intent and access the data it carries [1].

Exploitation

To exploit this vulnerability, an attacker must have local access to the device (e.g., by installing a malicious app) and register a receiver for the implicit intent. When Samsung Email sends the sensitive data via the implicit intent, the malicious app can capture that data without any additional permissions [1].

Impact

Successful exploitation allows a local attacker to obtain sensitive information from Samsung Email, such as email content or authentication tokens, leading to information disclosure [1].

Mitigation

The issue is resolved in Samsung Email version 6.1.94.2, released as part of the August 2024 security update [1]. Users should update their Samsung Email app to the latest version available via the Galaxy Store or Play Store.