Samsung Routines CVE-2026-21021

Physical access to the target Samsung device is required (CVSS 4.0 AV:P) - remote exploitation is not possible. The device must be running Android 16 on a Samsung Mobile Devices build prior to SMR May-2026 Release 1. The Routines feature must be present and interactable on the device; if Routines is inaccessible from the lock screen, the attacker would need to bypass or circumvent lock screen protections first, though the description does not explicitly state this requirement. No elevated privileges are required from the attacker's perspective (PR:N per CVSS 4.0), and no user interaction is needed beyond the attacker's own physical manipulation. Exploitation is not automatable (SSVC: Automatable: no), limiting this to manual, targeted attacks against specific devices.

Real-world risk is low to moderate for targeted scenarios, and effectively negligible at scale. The CVSS 4.0 score of 5.1 reflects a physical attack vector (AV:P) with high availability impact to the vulnerable system (VA:H) and no confidentiality or integrity impact - a narrow but non-trivial outcome. EPSS at 0.04% (13th percentile) is consistent with the physical access requirement that eliminates remote mass exploitation. SSVC confirms exploitation status as none, the attack is not automatable, and technical impact is only partial. No KEV listing further supports that this is not being actively leveraged in campaigns. A notable discrepancy exists: the 'Information Disclosure' tag applied to this CVE conflicts with the CVSS 4.0 impact metrics, which show VC:N (no confidentiality impact) and only VA:H - this inconsistency should be verified against the Samsung advisory before making scope-of-impact decisions. For most enterprise and consumer environments, this CVE represents a low-priority patch item unless physical device security is a primary threat model (e.g., law enforcement seizure, lost-device scenarios).

An attacker with hands-on access to an unpatched Samsung device running Android 16 - for example, a stolen or unattended phone - manipulates the Routines feature by supplying crafted input that bypasses input validation, causing the system to launch a privileged activity not normally available to the user context. No public exploit code exists at time of analysis, and the attack cannot be conducted remotely.