Samsung Routines CVE-2026-21022

The Routines feature must be present and active on the Samsung Mobile Device, which is a default Samsung One UI component on Android 15 and 16 and requires no special non-default configuration to be enabled. The CVSS 4.0 vector (AV:L/PR:N/UI:N) indicates any locally executing code or application on the device can trigger the flaw without requiring elevated privileges or user interaction. Exploitation is strictly limited by the local attack vector - the attacker must have local code execution on the target device, ruling out remote exploitation entirely. The vulnerability does not affect non-Samsung Android devices, Samsung devices running Android versions outside 15 and 16, or any device already updated to SMR May-2026 Release 1.

The CVSS 4.0 score of 6.9 reflects local-only access (AV:L) with no privilege prerequisites (PR:N), low attack complexity, no required user interaction, and high confidentiality impact on the vulnerable system (VC:H). The local attack vector is the primary risk limiter - remote unauthenticated exploitation is not possible. EPSS at 0.01% (3rd percentile) signals extremely low exploitation probability in the wild, aligned with SSVC's designation of exploitation as 'none' and technical impact as 'partial.' The vulnerability is not listed in CISA KEV, and no public POC is known. SSVC also rates it as not automatable, consistent with the local attack vector requiring per-device access. Despite high confidentiality impact, the combination of local-only vector, no observed exploitation, and low EPSS makes this a low operational priority for most enterprise environments, though Samsung device users handling sensitive data should apply the May 2026 security patch promptly.

A malicious application installed on a Samsung device running Android 15 or 16 (pre-SMR May-2026) invokes the Routines component in a context where its permissions are insufficient, triggering the improper handling flaw and reading sensitive information - such as account data or device state - that it is not authorized to access. Because the CVSS 4.0 vector specifies PR:N and UI:N, the malicious app requires no special privileges or user interaction beyond having local code execution on the device. No public proof-of-concept code is known at time of analysis.