Samsung Internet CVE-2026-21036

Local access to the target Android device is required, either through a co-resident application running in a low-privileged context (PR:L per CVSS 4.0) or direct physical/logical access by a user with a non-root account. No special Samsung Internet configuration is required (AT:N - no attack trigger conditions), and no victim user interaction is needed (UI:N). Exploitation is limited to devices running Samsung Internet versions prior to 30.0.0.39. The local-only attack vector (AV:L) is the primary limiting factor - remote unauthenticated exploitation is not possible. Root or system-level privileges are not required, but the attacker must have some form of local code execution or account presence on the device.

The overall CVSS 4.0 score of 6.3 reflects a moderate-severity finding, but the metric decomposition reveals a more nuanced picture. The local attack vector (AV:L) and low privilege requirement (PR:L) meaningfully constrain exploitation - an attacker needs physical or logical access to the device with at least a low-privileged account or application context. Attack complexity is Low (AC:L) with no special trigger conditions (AT:N) and no user interaction required (UI:N), meaning once access is established, exploitation is straightforward. The critical signal is the SC:H/SI:H/SA:H cluster: whatever sensitive data is exposed carries cascading high impact on external systems, elevating this beyond a simple information disclosure. No EPSS score was provided in the input data, and the absence of KEV listing and unreported POC suggests no confirmed widespread exploitation. The realistic threat profile is an on-device malicious application or a physically present attacker targeting browser-stored credentials or session data for lateral movement into web services.

A malicious Android application installed on the victim's device with only standard (low-privileged) app permissions exploits the authorization flaw in Samsung Internet to read sensitive browser data - such as stored credentials, cookies, or session tokens - without user interaction. The attacker's app then exfiltrates this data, enabling account takeover of web services the victim had authenticated to via the browser. No public exploit code has been identified at time of analysis, but the low attack complexity means a functional exploit would require minimal development effort once the vulnerable authorization boundary is identified.