Samsung Assistant CVE-2026-21032

Samsung Assistant prior to version 9.3.14 must be installed on the target Android device with the SmartHomeWidgetReceiver component present and active. The CVSS 4.0 vector (AV:L/PR:N/UI:N) confirms that the attacker must have local code execution on the same device - typically via a malicious application installed through social engineering, a compromised app store listing, or sideloading - but requires no elevated privileges and no user interaction beyond app installation. Remote network-based exploitation is not supported by this attack vector. Exploitation is further limited to Android platforms where Samsung Assistant is deployed; the attack does not affect other operating systems or Samsung Assistant implementations outside Android.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) confirms that no elevated privileges or user interaction are needed to exploit this locally, but the attack surface is strictly device-local - a remote network attacker cannot directly reach the component. The score of 6.9 (Medium under CVSS 4.0) appropriately reflects this constrained reach. Notably, the CVSS impact subscores show only confidentiality impact (VI:N/VA:N), yet the CVE description states 'execute arbitrary script,' suggesting potential for broader impact beyond pure data disclosure; this inconsistency should be validated against the vendor advisory. No EPSS score was provided in available data, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread or targeted exploitation. Overall, real-world risk is moderate: exploitation requires a malicious application already installed on the victim's device, limiting the attack to scenarios involving social engineering into sideloading apps or a compromised app store delivery chain.

An attacker distributes or tricks a user into installing a malicious Android application on a device running Samsung Assistant prior to version 9.3.14. The malicious app broadcasts a crafted intent targeting the exported SmartHomeWidgetReceiver component, which accepts the intent without permission validation due to the improper export. This causes arbitrary script execution within the Samsung Assistant process, enabling access to sensitive data held by the application. No public proof-of-concept code has been identified at time of analysis.