Samsung’s latest Galaxy Store update fixes a vulnerability that allows hackers to install apps without notifying users

Samsung has released an update to the Galaxy Store app to fix vulnerabilities that could potentially allow malicious sources to install apps without user permission. Two vulnerabilities have reportedly been detected on the Galaxy Store by a research team. These vulnerabilities only affect handsets running Android 12 or earlier. Android 13 users are not affected by this. Users can open the Galaxy Store on their phone and download and install the latest version 4.5.49.8 of the Galaxy Store app.

According to a report by the NCC research team, the Galaxy Store app, which comes pre-installed on Galaxy smartphones, has been detected with two security vulnerabilities CVE-2023-21433 and CVE-2023-21434. The vulnerabilities allow hackers to install malicious apps on vulnerable Samsung handsets without owner permission as well as execute JavaScript when launching a web page.

The report says that a pre-installed rouge app or malicious hyperlink in Google Chrome on Galaxy phones running Android 12 bypasses Samsung’s URL filter and installs any app available on the Galaxy Store. Moreover, they even launch an attacker-controlled web view. Notably, these vulnerabilities only affect Galaxy phones running Android 12, while phones supported by Android 13 are safe.

Therefore, to fix these bugs, Samsung has rolled out an updated version of the Galaxy Store app (version 4.5.49.8). Users can go to Galaxy Store settings on their phone, download and install the latest version of the app. Samsung has classified the aforementioned vulnerabilities as moderate risks.

Galaxy Store was reported to distribute rogue apps asking for excessive permissions, including phone access, earlier as well. In December 2021, different clones of Showbox movie hacking apps available on Galaxy Store were spotted infecting devices with malware. Tipster Max Weinbach reported a similar type of problem that was previously discovered on Huawei phones. He shared that installations of Showbox-based apps from the Galaxy store were stopped by Google’s Play Protect warning. At least five of the Showbox-based apps have been infected with dangerous malware.

---