CVE-2017-17692: Samsung Internet Browser Same Origin Policy bypass via JavaScript

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityHigh CVSS (7.5) information disclosure with public exploit code and very high EPSS, but no KEV listing and no evidence of ransomware use.

What it is

Samsung Internet Browser 5.4.02.3 fails to enforce the Same Origin Policy when crafted JavaScript redirects to a child tab and rewrites the innerHTML property. This lets a malicious page read content from another origin, exposing sensitive information that should be isolated by the browser.

Impact

An attacker can read data from other origins loaded in the browser, such as authenticated page content or tokens, leading to information disclosure. No code execution or write access is gained; the gain is confidentiality only.

Attack surface

Reached over the network by luring a user to a malicious web page that runs the crafted JavaScript; no authentication is required and the CVSS vector indicates no user interaction beyond visiting the page. The flaw is in the browser's tab and DOM handling, not in a server component.

Exploitation

Public exploit code exists, including a Metasploit auxiliary module and Exploit-DB entry, and EPSS is very high (0.788, 99.6th percentile), though the CVE is not listed in CISA KEV.

What to do

• Update Samsung Internet Browser to a version later than 5.4.02.3; the record does not name a fixed version, so confirm the patched release with Samsung.
• If patching is not possible, restrict or block use of the affected browser for accessing sensitive or authenticated sites.
• Enforce a policy requiring an up-to-date, supported browser for corporate and web application access.
• Segment or monitor traffic from devices running the affected browser version.
• Review web applications for reliance on Same Origin Policy alone to protect sensitive data.

Detection

• Monitor for the Metasploit auxiliary module samsung_browser_sop_bypass or its network signatures.
• Alert on Samsung Internet Browser user agents matching version 5.4.02.3 in web proxy or application logs.
• Hunt for child-tab redirect and innerHTML rewrite patterns in client-side JavaScript on untrusted pages.
• Correlate outbound requests from affected browser sessions to unexpected origins.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.