EUVD-2026-26192Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector confirmed by AV:L; PR:L chosen because device presence or an installed app context is a practical prerequisite; C:N and A:N as no confidentiality or availability impact is described.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify the installation restriction of specific application.
AnalysisAI
PackageManagerService on Samsung Mobile Devices running Android 14, 15, and 16 allows local attackers without elevated privileges to bypass application installation restrictions by exploiting insufficient verification of data authenticity. The affected component fails to adequately validate the integrity of data governing app installation policies, enabling unauthorized modification of those restrictions on unpatched devices. No public exploit code has been identified and SSVC rates exploitation as none, but the impact is significant in enterprise MDM and parental-control deployments where installation restrictions are an active security control.
Technical ContextAI
PackageManagerService is a core Android system component responsible for managing application lifecycle events including installation, uninstallation, and enforcement of installation access policies. Samsung's proprietary Android build extends this service with custom installation restriction mechanisms. The vulnerability - no CWE is formally assigned, though functionally analogous to CWE-345 (Insufficient Verification of Data Authenticity) - means the service does not sufficiently validate the source or integrity of data that determines whether specific applications are permitted to install. The affected CPE is cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:*, covering Samsung's full Android device lineup across Android 14, 15, and 16. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) confirms low-complexity local exploitation with no attack requirements or prerequisites beyond device access.
RemediationAI
Apply Samsung's SMR Mar-2026 Release 1 security update, which delivers the fix for Android 14, 15, and 16 per the vendor advisory at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=03. Organizations managing Samsung device fleets via MDM should prioritize update deployment on any devices where application installation restrictions are an enforced security control, as those restrictions cannot be trusted on unpatched devices. As a compensating control where patching is delayed, supplement device-level installation restrictions with server-side MDM enforcement and network-based application allowlisting, since device-side restriction integrity is compromised on vulnerable builds. Note that these compensating controls add management overhead and may affect legitimate application deployment workflows.
More in Samsung Mobile Devices
View allLocal privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
Improper access control in the Weaver component of Samsung Mobile devices allows a local attacker without elevated privi
Improper input validation in Samsung Contacts on Samsung Mobile devices prior to SMR Aug-2026 Release 1 enables local at
Unauthorized file deletion via improperly exported Android components in Samsung Contacts prior to SMR Aug-2026 Release
Incorrect privilege assignment in the Telephony component of Samsung Mobile devices prior to SMR Jun-2026 Release 1 perm
Improper permission handling in the Routines automation feature on Samsung Mobile Devices exposes sensitive information
AppLock on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes improperly exported Android application compon
Out-of-bounds memory write in Samsung's SveService component allows local attackers holding high privileges to execute a
External control of file name in Samsung AODManager prior to April 2026 SMR Release 1 allows privileged local attackers
FactoryCamera on Samsung Mobile Devices prior to SMR May-2026 Release 1 exposes a unique device identifier to local low-
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today