Samsung FactoryCamera CVE-2026-21015

Exploitation requires local access to the Samsung Mobile Device with at least low-privilege execution context (PR:L per CVSS 4.0), meaning an attacker-controlled application must already be installed on the device. The FactoryCamera application must be present, which is standard on Samsung OEM devices running Android 14, 15, or 16 prior to the May 2026 patch. No network exposure exists - this is a purely local attack vector (AV:L). No user interaction is required once the malicious app is co-resident. Exploitation is limited by: (1) the requirement for local app installation (not achievable remotely without chaining a separate vulnerability), (2) no automation pathway per SSVC (Automatable: no), and (3) impact is limited solely to confidentiality - no integrity or availability compromise is possible through this flaw alone.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) places this at 6.8 Medium, reflecting high confidentiality impact but constrained by local access (AV:L) and a low-privilege prerequisite (PR:L). The EPSS score of 0.01% (1st percentile) indicates extremely low observed exploitation probability relative to the broader CVE population. SSVC further classifies exploitation as 'none', automatable as 'no', and technical impact as 'partial', all pointing away from urgency. This vulnerability is not listed in the CISA KEV catalog and no POC has been identified. The primary real-world risk is passive device tracking or fingerprinting enabled by leaking the unique identifier to a malicious co-resident application, which is meaningful on consumer mobile devices but does not enable remote compromise, code execution, or data integrity violations. The gap between the VC:H metric and the SSVC 'partial' technical impact rating is consistent with a scenario where the exposed data has high value (a persistent unique identifier) but the broader blast radius is limited to confidentiality on the local device.

A malicious application installed on the Samsung device with only standard low-privilege permissions reads FactoryCamera's improperly permissioned resource - such as a world-readable file or unprotected content provider - to obtain the device's unique identifier. This identifier can then be exfiltrated to a remote server, enabling persistent device tracking across factory resets or advertising identifier changes. No exploit code has been publicly identified, and exploitation requires the attacker's app to already be installed on the target device.