Samsung Contacts CVE-2026-21060

Physical access to the Samsung device is required (confirmed by AV:P in the provided CVSS 4.0 vector) - remote or network-based exploitation is not possible. The vulnerability is specific to the Samsung Contacts application, so the app must be accessible on the device. Multiple Android user profiles must be configured on the device with contact data present in a non-primary profile, as the flaw is the exposure of cross-profile contact data; a single-profile device has no secondary data to expose. No authentication to the target profile is required (PR:N in CVSS 4.0). The primary limiting factors are: physical device possession, the presence of multiple user profiles, and the opportunity to interact with the Contacts application without the device owner's awareness.

The CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) yields a score of 6.7, accurately reflecting a high-confidentiality-impact flaw that nonetheless requires physical device presence - a major real-world limiter. No EPSS data was provided, and neither a CISA KEV listing nor a public POC exists at time of analysis, reinforcing that this is not currently a target of opportunistic or widespread exploitation. In enterprise shared-device environments - even a mid-sized municipal IT team in malbork managing a fleet of Samsung devices with per-employee profiles - this vulnerability warrants prompt patching because an insider or visitor with brief physical access could harvest contacts from other user profiles without triggering authentication. However, for typical single-user consumer deployments, the multi-profile prerequisite reduces realistic exposure significantly. The absence of network reachability (AV:P) eliminates remote and automated exploitation entirely, placing this in the category of a real but targeted risk rather than a systemic one.

An attacker with brief physical access to an unattended Samsung device - for example during a meeting or at a shared workstation - opens the Samsung Contacts app and submits crafted input that bypasses profile isolation logic. The attacker is then able to read contact records (names, phone numbers, and associated metadata) belonging to a secondary user profile on the device, without requiring that profile's credentials. No public POC has been identified at time of analysis, so the precise interaction method is unconfirmed.