Samsung Contacts CVE-2026-21059

Exploitation requires that a malicious application is already installed on the target Samsung device - either through user installation from an unofficial source, social engineering, or a prior compromise. The attacker's malicious app does not need to hold any special Android permissions; it only needs to be installed on the same device as the vulnerable Samsung Contacts version. The exported component must be reachable via an explicit or implicit Intent, which is the condition created by the improper export. Exploitation is limited to local context (AV:L); purely remote, unauthenticated network-based exploitation is not possible. Devices already updated to SMR Aug-2026 Release 1 or later are not affected.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N) reflects a locally-exploitable flaw with high integrity impact, no confidentiality or availability impact, and no privilege requirement. The PR:N rating in a local Android context means any installed application - including those obtained from unofficial sources - can trigger the exported component without requesting any Android permissions. Attack complexity is low with no additional attack requirements (AT:N), making exploitation straightforward once a malicious app is present. There is no CISA KEV listing and no known POC, which reduces immediate mass-exploitation risk. EPSS data was not provided. The real-world risk is moderate: Samsung Galaxy devices are widely deployed, but exploitation requires the attacker to already have a malicious app installed on the victim device, limiting exposure compared to a pure remote attack. The 'Information Disclosure' tag in the source data is inconsistent with the description's file-deletion-only impact - this discrepancy should be verified against the Samsung advisory.

An attacker distributes a malicious Android application - potentially disguised as a utility app - that, once installed by the victim, silently invokes the improperly exported Samsung Contacts component via an explicit Intent. The malicious app passes a targeted file path to the component, causing Samsung Contacts to delete that file using its own elevated privileges without any user interaction or visible indication. No public proof-of-concept has been identified at time of analysis, but the straightforward nature of Android Intent-based component invocation means a functional exploit would require minimal development effort.