Arbitrary file write via unverified broadcast caller

Improper intent verification in Samsung Galaxy Store before 4.5.71.8 allows local attackers to write arbitrary files with its privileges. A broadcast receiver processes an incoming intent without properly verifying its caller, causing attacker-directed file writes under the application's identity. Exploitation requires local code able to address the receiver, and Samsung has not published the receiver class or writable paths.