High

Improper access control in Samsung Galaxy Store app installation flow

IdentifiersCVE-2023-21433CWE-284

CVE-2023-21433 is an improper access control vulnerability in Samsung Galaxy Store prior to version 4.5.49.8. The flaw allows a local application on the same Samsung device to invoke the exported activity com.sec.android.app.samsungapps.detail.alleypopup.AlleyDetailActivity and supply attacker-controlled intent extras that drive the Galaxy Store installation workflow. According to the provided content, the GUID extra identifies the target package to install from Galaxy Store, directInstall can trigger automatic installation, and directOpen can immediately launch the installed app. The vulnerable processing path includes AlleyBundleContainer.parseValues and a downstream method identified as b(AlleyDetailActivity), which ultimately prepares the download and installation task. The issue affects Samsung devices running Android 12 and below; the content states Android 13 changes prevent exploitation on newer versions.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a malicious local app to cause silent or near-silent installation of arbitrary applications available in Galaxy Store without the user’s knowledge, and optionally auto-launch the installed app. This can be used to introduce unwanted software, expand attacker capabilities on the device, facilitate follow-on abuse through the newly installed application, and undermine user trust and application-installation controls. Because the attacker must already have code execution as a local app, the flaw is best characterized as a privilege/permission boundary bypass within the app installation flow rather than initial compromise.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure by restricting installation of untrusted or unnecessary local applications, monitoring for unexpected Galaxy Store-driven installs, and using mobile device management or enterprise controls to limit sideloading and unauthorized app deployment. Prioritize patching Samsung devices that remain on Android 12 or below, since the provided content indicates those versions are exploitable.

Remediation

Patch, then assume compromise.

Update Samsung Galaxy Store to version 4.5.49.8 or later. The provided content states Samsung released version 4.5.49.8 to remediate CVE-2023-21433. Devices should also be upgraded to Android 13 or later where possible, as the content indicates the issue affects Android 12 and below due to platform behavior changes in Android 13.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Samsung ElectronicsGalaxy Storeapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyberthroneNews

Nov 11, 2025

Samsung Galaxy Zero-Day CVE-2025-21042 Exploited by LANDFALL Spyware

Unknown (only referenced as related content; described generally as Samsung Galaxy Store app vulnerabilities).

ncc group researchNews

Jan 20, 2023

Technical Advisory – Multiple Vulnerabilities in the Galaxy App Store (CVE-2023-21433, CVE-2023-21434)

An improper access control vulnerability in the Samsung Galaxy App Store app that allows a local malicious app on Samsung devices running Android 12 or below to trigger silent installation of apps from the Galaxy App Store without the user's knowledge.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity