Android CVE-2026-20990

Local authentication required. Vulnerable Secure Folder versions prior to SMR Mar-2026 Release 1 with improper component export protection. Attacker must have local user account access to device.

Despite the high CVSS 4.0 score of 8.4, the real-world risk appears moderate based on several factors. The local attack vector (AV:L) requires an attacker to have already compromised the device or convince a user to install malicious software, and low privileges (PR:L) are still required. The lack of KEV listing indicates no known active exploitation, and the absence of EPSS data suggests limited exploitation probability. The high confidentiality (VC:H) and integrity (VI:H) impact scores reflect the sensitivity of data protected by Secure Folder, making this a priority for organizations using Samsung devices with sensitive data, but not an emergency patch scenario given the local access requirement and no evidence of wild exploitation.

An attacker would need to convince a user to install a malicious application on their Samsung device, which would then exploit the improperly exported components in Secure Folder to launch activities with elevated privileges, potentially accessing or modifying protected data within the secure container. The attack requires no user interaction after the malicious app is installed, as indicated by the UI:N in the CVSS vector, making it particularly dangerous once the initial foothold is established. No public proof-of-concept exists for this vulnerability at this time.