CVE-2021-25520

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Insecure caller check and input validation vulnerabilities in SearchKeyword deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to execute script codes in Samsung Internet.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-20 CWE-79

Affected software

Vendor	Product	Versions
Samsung Mobile	Samsung Internet	>= -, < 16.0.2

References

https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12Vendor Advisory

Timeline

Published: Dec 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-255213.3Insecure caller check in sharevia deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to get current tab URL in S CVE-2021-255223.3Insecure storage of sensitive information vulnerability in Smart Capture prior to version 4.8.02.10 allows attacker to access victim's captu CVE-2021-255233.3Insecure storage of device information in Samsung Dialer prior to version 12.7.05.24 allows attacker to get Samsung Account ID.CVE-2021-255243.3Insecure storage of device information in Contacts prior to version 12.7.05.24 allows attacker to get Samsung Account ID.CVE-2021-255256.5Improper check or handling of exception conditions vulnerability in Samsung Pay (US only) prior to version 4.0.65 allows attacker to use NFC CVE-2021-255265.5Intent redirection vulnerability in Samsung Blockchain Wallet prior to version 1.3.02.8 allows attacker to execute privileged action.CVE-2021-255273.3Improper export of Android application components vulnerability in Samsung Pay (India only) prior to version 4.1.77 allows attacker to acces CVE-2021-256307.8"loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user. Before doing anything else "loolfo CVE-2021-256318.8In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented CVE-2021-256337.5LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the docum CVE-2021-256347.5LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the docum CVE-2021-256355.5An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untruste