Samsung OmaCP CVE-2026-21020

Exploitation requires a Samsung Android device running Android 14, 15, or 16 with an unpatched OmaCP version (prior to SMR May-2026 Release 1), and the ability to install and execute a malicious application on the same device. The attacker does not require any elevated system privileges - the CVSS 4.0 vector confirms PR:N, meaning any co-resident app can send intents to the exported component. Exploitation is not automatable remotely (SSVC: Automatable: no) and is constrained to the local attack surface (AV:L), meaning remote network-based exploitation is not possible without a separate initial access vector. The scope is limited to Samsung devices within the affected Android version range - iOS, stock Android, and other OEM devices are not affected. The specific privileged functions exposed by the exported OmaCP component are not disclosed in available public data.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N, score 5.1) indicates a locally exploitable flaw with low complexity and no required privileges - consistent with Android's app sandbox model where any installed application can interact with exported components regardless of its own privilege level. Confidentiality, integrity, and availability impacts are all rated low (VC:L/VI:L/VA:L), with no subsequent-system impact. EPSS at 0.01% (3rd percentile) signals extremely low observed exploitation probability across the threat landscape. SSVC corroborates this: exploitation is none, the attack is not automatable, and technical impact is partial. The Information Disclosure tag alongside component export suggests that triggering privileged functions may include reading protected configuration data or device identifiers. There is no conflict between signals here - all available data consistently points to a real but low-urgency local vulnerability, meaningful primarily in scenarios where untrusted or malicious applications can be installed.

A malicious application installed on an unpatched Samsung device running Android 14-16 crafts an intent targeting OmaCP's improperly exported component and sends it without any special permissions, triggering a privileged provisioning or configuration function. The attack requires only the malicious app to be installed on the device - for example, via a sideloaded APK or a compromised listing - and executes without user interaction once the app is running. No public exploit code has been identified at time of analysis.