Samsung AppBlock CVE-2026-21031

Q: What is the CVSS score of CVE-2026-21031?

CVE-2026-21031 has a CVSS 4.0 base score of 5.2 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34803 MEDIUM

Incorrect Authorization (CWE-863)

2026-06-05 SamsungMobile

GHSA-7p4c-vmfg-g296

Authentication Bypass Samsung Mobile Devices Samsung Mobile

5.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.2 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 13:33 vuln.today

CVSS changed

Jun 05, 2026 - 11:22 NVD

5.2 (MEDIUM)

CVE Published

Jun 05, 2026 - 10:15 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity. User interaction is required for triggering this vulnerability.

AnalysisAI

Improper authorization in Samsung's AppBlock application on Android 15 and 16 devices allows a local, low-privileged attacker to launch arbitrary Android Activities without proper permission checks. Exploitation requires passive user interaction (CVSS 4.0 UI:P) and local device access, but the confidentiality impact on the vulnerable system is rated High (VC:H), consistent with the reported Information Disclosure tag. No public exploit code exists and the vulnerability is not listed in CISA's KEV catalog at time of analysis; Samsung has released a patch in SMR Jun-2026 Release 1.

Technical ContextAI

AppBlock is a Samsung-developed application management feature present on Samsung Mobile Devices. The vulnerability arises from an authorization control failure in how AppBlock manages Activity launching - a fundamental Android component interaction mechanism. When an Android application improperly exports Activities or fails to enforce permission checks on Intent-driven launches, low-privileged local apps can invoke those Activities outside their intended context. This class of flaw aligns with improper authorization patterns (no CWE is formally assigned in the NVD entry, though CWE-285 Improper Authorization or CWE-926 Improper Export of Android Application Components would be applicable). The affected CPE is cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:*, covering the full Samsung Mobile Devices product line running Android 15 and 16 prior to the June 2026 SMR patch.

RemediationAI

Apply Samsung's SMR Jun-2026 Release 1 security update, which resolves this vulnerability on Android 15 and Android 16 devices. Update instructions and confirmation of the patched release are provided in Samsung's official security bulletin at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=06. For enterprise deployments managed via Samsung Knox, administrators should prioritize pushing this monthly security update to affected device fleets. As a compensating control prior to patching, restrict installation of untrusted or sideloaded applications on managed devices, as exploitation requires a low-privileged malicious app to be present locally - this reduces the attack surface without eliminating the underlying flaw. Blocking unknown sources in device policy is actionable via Knox MDM but may impact legitimate app distribution workflows.