Galaxy Wearable CVE-2026-21013

CVSS 6.9 (Medium-High) with CVSS:4.0 vector indicates confidentiality impact is HIGH (VC:H), attack vector is LOCAL (AV:L), and no authentication required (PR:N). The attack is straightforward (AC:L) and requires no user interaction (UI:N). This is a realistic priority: local access is a plausible threat model for multi-user devices or users with malicious apps installed. The CVSS vector's NO integrity, availability, or scope impact narrows the threat to information disclosure only. No KEV status or POC data provided; however, permission misconfigurations are trivially exploitable once discovered, making this a practical concern for any user sharing device access. The LOCAL attack vector limits exposure compared to remote vulnerabilities, but the HIGH confidentiality impact justifies patching before sensitive user data (credentials, health records, authentication tokens) is exposed.

An attacker with local access to a Galaxy Wearable-paired Android device or the wearable itself identifies world-readable or group-readable files in the Galaxy Wearable application's data directory (e.g., /data/data/com.samsung.android.app.watchmanagerstub/ or equivalent). The attacker reads these files without authentication to extract sensitive information such as user credentials, paired device identifiers, health metrics, or authentication tokens, then uses this data for lateral movement, identity theft, or unauthorized access to companion services.