EUVD-2026-42824
GHSA-2mvw-r55c-8x68
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack via co-resident app requiring no permissions (PR:N, AV:L); high confidentiality impact only, no integrity or availability effect, scope unchanged.
Primary rating from Vendor (samsung).
CVSS VectorVendor: samsung
Lifecycle Timeline
2DescriptionCVE.org
Improper export of android application components in InputSharing prior to version 2.7.01.4 allows local attackers to access sharing data.
AnalysisAI
Improper export of Android application components in Samsung's InputSharing app (prior to version 2.7.01.4) exposes internal sharing data to any co-resident application on the same device. The flaw allows a local attacker - via a malicious app installed on the same Samsung device - to silently access data transiting the InputSharing component without requiring any special Android permissions. No active exploitation has been confirmed (no CISA KEV listing), and a vendor-released patch at version 2.7.01.4 is available per the Samsung Mobile Security advisory.
Technical ContextAI
InputSharing is a Samsung-proprietary Android application that facilitates data sharing across Samsung devices or features (consistent with Samsung's cross-device ecosystem, e.g. Link to Windows or Multi Control). Android's component model allows Activities, Services, ContentProviders, and BroadcastReceivers to be declared 'exported', making them callable by any other app on the device. When export is not restricted via android:permission attributes or explicit android:exported=false declarations, any third-party app can invoke those components and interact with their data. This vulnerability is characteristic of CWE-926 (Improper Export of Android Application Components), though NVD lists CWE as N/A for this record. The CVSS 4.0 vector (AV:L/PR:N/VC:H) confirms the local-only, no-privilege-needed nature of the flaw, with high confidentiality impact limited to the vulnerable system itself. The 'Google' tag likely reflects Google's Android vulnerability classification taxonomy or Play Protect reporting channel used by Samsung's security team.
RemediationAI
Update Samsung InputSharing to version 2.7.01.4 or later, available through the Samsung Galaxy Store or via an OTA firmware update for applicable Samsung devices. The vendor advisory is published at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=07 and should be consulted for device-specific update guidance. If immediate patching is not possible, compensating controls include restricting device installation to trusted app sources only (disable 'Install unknown apps'), enforcing Android Enterprise policies that limit co-resident third-party applications in managed device environments, and avoiding transmission of sensitive data (credentials, confidential files) through the InputSharing feature until the patch is applied. Disabling InputSharing entirely via device settings would eliminate the attack surface with the trade-off of losing cross-device sharing functionality. No integrity or availability impact has been identified, so service continuity is not a patching blocker.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today