Samsung Assistant CVE-2026-21033

Local access to the Android device is required - specifically, the ability to execute code on the device, most realistically via a malicious application installed from an untrusted source (sideloaded APK, third-party app store). The CVSS 4.0 vector (PR:N, UI:N) confirms no special OS-level privileges or victim interaction are needed once the malicious app is installed. The vulnerable condition is the presence of Samsung Assistant prior to version 9.3.14 with its ExpressHomeWidgetReceiver component improperly exported without adequate permission enforcement. Exploitation is strictly bounded by the local attack vector (AV:L) - remote unauthenticated exploitation over a network is not possible. Limitations on exploitation include: the attacker must achieve local code execution on the target device (a non-trivial prerequisite for targeted attacks), the impact is limited to confidentiality (no integrity or availability impact per CVSS), and the vulnerability does not affect the underlying Android OS or other applications.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) confirms local attack vector with low complexity, no required privileges, no user interaction, and high confidentiality impact on the vulnerable component. Crucially, the local attack vector caps real-world blast radius to on-device threats - remote network exploitation is not feasible under this vector. The 'Information Disclosure' tag aligns with the VC:H / VI:N / VA:N impact profile, suggesting the primary risk is unauthorized access to data rather than device takeover or availability disruption. No EPSS score is available in the provided data. The CVE is not listed in CISA KEV, and no POC has been identified. Taken together, this represents a moderate-priority issue: meaningful for organizations managing large Android device fleets with strict data-handling requirements (e.g., enterprise MDM environments), but lower urgency than network-exploitable vulnerabilities for typical consumer users who do not sideload untrusted applications.

An attacker distributes a malicious Android application - either through a third-party app store or via sideloading - onto a device running Samsung Assistant prior to 9.3.14. Once installed, the malicious app sends a specially crafted intent directly to the improperly exported ExpressHomeWidgetReceiver component, bypassing access control checks. This triggers execution of an arbitrary script within Samsung Assistant's context, exposing confidential data accessible to the assistant. No public POC has been identified at time of analysis.