Galaxy Watch CVE-2026-21019

Local access to the Galaxy Watch device through physical interaction, USB debugging (ADB) enabled, or an already-installed unprivileged application that can invoke the vulnerable FacAtFunction component. The CVSS vector PR:N indicates no authentication is required once local access is established, meaning the vulnerable function is exposed to unprivileged local processes. Specific limiting factors include: the device must be unlocked or ADB authorization previously granted from a trusted computer; the user must have enabled Developer options and USB debugging (non-default configuration); or a malicious app must already be installed with sufficient permissions to interact with system services. Physical theft or unattended device scenarios represent the most realistic attack path, as wearables are typically worn and less susceptible to remote compromise vectors compared to smartphones.

Real-world risk is moderate despite the 8.6 CVSS score. The vulnerability requires local access (AV:L), which significantly constrains the attack surface compared to remotely exploitable flaws - attackers need physical device access, USB debugging enabled, or a malicious app already installed with sufficient permissions to interact with the vulnerable component. The EPSS score of 0.03% (10th percentile) indicates security researchers assess exploitation probability as very low, likely due to the local attack vector and the limited attacker interest in wearable devices compared to smartphones. No CISA KEV listing confirms this is not being exploited in the wild. No public POC exists, raising the skill barrier for exploitation. However, the impact is severe (VC:H/VI:H/VA:H with system privilege execution), meaning successful exploitation grants full device control. The SSVC decision framework would likely categorize this as 'Scheduled' priority rather than 'Immediate' - the local vector makes it non-automatable, technical impact is total system compromise but limited to single devices, and no evidence of active exploitation exists. Primary risk scenarios involve targeted attacks against high-value individuals with physical device access, or as a post-compromise escalation step after malware installation.

An attacker with physical access to an unlocked Galaxy Watch or a user's paired smartphone enables USB debugging on the watch through the Galaxy Wearable app settings. Using ADB shell, the attacker sends maliciously crafted input to the FacAtFunction component, triggering the input validation flaw. The improper validation allows the attacker's payload to execute with system-level privileges, granting full control over the device to install persistent malware, exfiltrate health data, intercept notifications, or brick the device.