Samsung SemClipboardService CVE-2026-21062

Exploitation requires local access to an affected Samsung Mobile Device running software prior to SMR Aug-2026 Release 1, combined with at least low (standard user-level) privileges on the device - consistent with the CVSS 4.0 PR:L metric. The vulnerable component is SemClipboardService, a Samsung-proprietary service not present in stock Android; exploitation is therefore limited to Samsung-manufactured devices running their custom Android layer. No user interaction is required (UI:N). The attack vector is strictly local (AV:L), ruling out remote or network-based exploitation. Exploitation is further limited to whatever data happens to reside in the clipboard at the time of the attack - there is no persistent access to clipboard history unless the device retains it.

The CVSS 4.0 score of 4.8 with vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N reflects a constrained local attack requiring at minimum a standard user-level process on the device - no network exposure, no privilege escalation path, and limited impact scope. No EPSS data, CISA KEV listing, or public POC is present in the provided intelligence, which reduces urgency for most defenders. That said, the practical sensitivity of clipboard data (passwords, OTPs, session tokens, PII) means the VC:L rating understates business risk in enterprise or BYOD contexts where Samsung devices are managed at scale. The absence of an assigned CWE is a minor data gap; the authorization bypass characterization by the vendor is consistent with the CVSS metrics. Overall this is a genuine but low-to-moderate priority issue: prioritize patching on managed enterprise fleets before consumer endpoints.

A malicious application installed on the device with standard user-level privileges calls SemClipboardService and, due to the missing authorization check, successfully retrieves current clipboard contents. If the device user has recently copied a password, authentication token, or OTP, the attacker application silently exfiltrates it without any visible indication to the user. No public exploit code has been identified at time of analysis.