Executive brief
Samsung Escargot, an open-source JavaScript engine, contains a flaw that could allow an attacker to manipulate memory pointers. This vulnerability could lead to unauthorized data access or system instability. In a worst-case scenario, it could allow an attacker to gain control over the application using the engine.
Technical details
A type confusion vulnerability (CWE-843) exists in Samsung's Escargot JavaScript engine. The flaw occurs when the engine accesses a resource using an incompatible type, specifically allowing for pointer manipulation. According to the vendor's CVSS assessment, the attack vector is local with high complexity, suggesting that while difficult to trigger, it can result in high integrity and availability impacts. A fix has been identified in the project's GitHub repository via pull request #1554.
Affected products
- Samsung Escargot 97e8115ab1110bc502b4b5e4a0c689a71520d335
Timeline
- 2026-04-08: patched: Fix merged in GitHub pull request 1554
- 2026-04-13: disclosed: Initial disclosure by Samsung
- 2026-06-02: advisory: NVD initial analysis completed