Executive brief
Samsung Escargot is an open-source JavaScript engine used in various embedded environments like smart TVs and appliances. A security flaw in how it handles memory buffers could allow an attacker to execute malicious code or crash the application when a user visits a specially crafted website or interacts with malicious web content. This poses a significant risk to device stability and the privacy of user data handled by the engine.
Technical details
An out-of-bounds write vulnerability exists in Samsung's Escargot JavaScript engine within the 'ArrayBuffer.prototype.transfer' implementation. The root cause is a lack of proper size validation when resizing or transferring buffers, specifically failing to check 'newByteLength' against the 'maxByteLength' of resizable ArrayBuffers. An attacker can exploit this by providing a malicious index or length value, leading to a buffer overflow. This is reachable via network-delivered JavaScript (e.g., a malicious webpage) and requires minimal user interaction. A fix involving enhanced size checking in 'src/builtins/BuiltinArrayBuffer.cpp' has been identified in the project's pull requests.
Affected products
- Samsung Escargot 36f5fb58366a67b713c02f6fd985e924fcc09e31
Timeline
- 2026-05-21: patched: Pull request 1579 submitted to address the size checking issue.
- 2026-05-27: advisory: CVE-2026-8915 published by Samsung TV & Appliance.