Samsung Internet up to 26.0.3.1 ClientProvider insufficient permissions or privileges

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Samsung Internet. The affected element is an unknown function of the component ClientProvider. This manipulation causes insufficient permissions or privileges. This vulnerability appears as CVE-2025-20995. The attack requires local access. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Samsung Internet and classified as problematic. Affected by this vulnerability is an unknown functionality of the component ClientProvider. The manipulation with an unknown input leads to a insufficient permissions or privileges vulnerability. The CWE definition for the vulnerability is CWE-280. The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Improper handling of insufficient permission in ClientProvider in Samsung Internet installed on non-Samsung Device prior to version 28.0.0.59 allows local attackers to read and write arbitrary files.

The advisory is shared at security.samsungmobile.com. This vulnerability is known as CVE-2025-20995 since 11/06/2024. The exploitation appears to be difficult. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1222 for this issue.

Upgrading to version 28.0.0.59 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-16826). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Samsung

Name

• Internet

Version

• 5.0.9
• 6.2.01.12
• 6.4.0.15
• 13.0.1.60
• 13.2.1.46
• 13.2.1.70
• 14.0.1.20
• 14.0.1.62
• 15.0.2.47
• 16.0.2
• 16.0.2.19
• 16.0.6.23
• 16.2.1
• 17.0.1.69
• 17.0.7.34
• 18.0.4.14
• 21.0.0.41
• 22.0.0.35
• 24.0
• 24.0.0.0
• 24.0.0.41
• 24.0.3.2
• 25.0.0.41
• 26.0.3.1

License

• commercial

Website

• Vendor: https://www.samsung.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion