Samsung Galaxy Store: five-bug chain to arbitrary APK installation

The Cloud Games feature uses a deeplink to install an auxiliary Shell APK to a predictable path without integrity checks.

The Store's custom signature validation downgrades from scheme v3 to v2 and does not verify that the signature block matches the actual APK data (the attacker copies the v2 signature block from the original Shell APK into their payload — the Store accepts it via v2, while the Android system installer validates it via v3).

The exported SmartSwitchReceiver, without permission checks, allows path traversal via new File(...) during data restore.

The authentication confirmation protocol uses Random initialized with System.currentTimeMillis().

A NullPointerException in IapReceiver forces the Store to crash and restart on demand, narrowing the brute-force window for the seed.