A now-patched security bug has been disclosed in the Galaxy Store app for Samsung devices that may potentially lead to remote command execution on vulnerable phones. The vulnerability, which affects Galaxy Store version 4.5.32.4, relates to a Cross-Site Scripting (XSS) bug that occurs when handling certain deeplinks. “Here, by not checking the deeplink securely, when a user accesses a link from a website containing the deeplink, the attacker can execute JavaScript (JS) code in the webview context of the Galaxy Store application,” stated SSD Secure Disclosure. XSS attacks allow attackers to insert and run a malicious JS code when victims access a rogue website through a browser or another program.