EUVD-2026-12293Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Improper verification of intent by broadcast receiver in Settings prior to SMR Mar-2026 Release 1 allows local attacker to launch arbitrary activity with Settings privilege. User interaction is required for triggering this vulnerability.
AnalysisAI
A broadcast receiver in Android Settings fails to properly verify intents prior to the March 2026 Security Maintenance Release 1, allowing a local attacker with limited privileges to launch arbitrary activities with Settings-level permissions. The vulnerability requires user interaction to trigger and carries a CVSS 4.0 score of 6.8, reflecting high confidentiality and integrity impact. No public exploit or KEV designation is currently documented, but the local attack vector and privilege escalation potential warrant prompt patching.
Technical ContextAI
This vulnerability affects Android's Settings application broadcast receiver mechanism, which is responsible for handling inter-process communication (IPC) via Intent broadcasts. The root cause is improper verification of incoming intents before processing, classified under CWE categories related to insufficient input validation and improper access control on IPC mechanisms. Broadcast receivers are a standard Android IPC component that listen for system-wide or application-specific broadcasts; without strict intent verification (typically via permission checks, action whitelisting, or signature validation), a malicious local application can craft a spoofed broadcast to trigger unintended Settings functionality. The Settings application runs with system privileges, making it a high-value target for privilege escalation attacks. The vulnerability manifests in Android versions prior to the March 2026 SMR Release 1 patch level, affecting multiple Android device manufacturers and models that have not yet applied this security update.
RemediationAI
Apply the March 2026 Security Maintenance Release 1 patch or later to your Android device as soon as available from your device manufacturer or carrier. Users of Nexus/Pixel devices should check for over-the-air (OTA) updates through Settings > About Phone > System Update, or manually download factory images from https://developers.google.com/android/images. Third-party device manufacturers should obtain and deploy the updated Settings package from their OEM or Google's Android release channels. Until patching is feasible, restrict installation of untrusted applications from outside the Google Play Store, enforce managed device policies via MDM solutions to disable sideloading, and monitor device activity logs for suspicious Settings-related IPC attempts. For enterprise deployments, consider requiring device administrator privileges to be granted only after thorough vetting and mandate regular security update compliance via conditional access policies.
More in Samsung Mobile Devices
View allOut-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of li
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimage
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today