Samsung AppLock CVE-2026-21063

Physical access to the Samsung device is the non-negotiable prerequisite (CVSS AV:P). The AppLock feature must be configured and actively protecting at least one application on the device. Exploitation can be performed via ADB (requiring USB debugging to be enabled) or via a malicious application already installed on the device; the latter does not require developer mode. The OS-level screen lock state is not specified as a prerequisite - it is possible the attack is viable on a device whose screen lock is already dismissed. Factors limiting exploitation: physical possession is required; remote or network-based exploitation is not possible by design; the attack is entirely contained to the device's own application layer (no lateral movement or scope change).

The CVSS 4.0 vector AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N scores 6.8 and accurately reflects the core constraint: physical device possession is mandatory. This single factor substantially narrows the realistic threat population to theft, border inspection, or coercive access scenarios rather than remote mass exploitation. No EPSS data was provided, and this CVE does not appear in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The high confidentiality and integrity impact scores are credible - a bypassed AppLock gives unfettered read/write access to whatever applications are protected. AC:L and UI:N confirm that once in physical possession, exploitation requires no complex preconditions and no victim cooperation. The absence of a scope change (SC:N/SI:N/SA:N) means impact is contained to the vulnerable system itself. Overall, this is a genuine but narrow-scope risk: high impact within its threat model but impractical for remote or automated exploitation.

An attacker with physical access to a Samsung device - for example, a stolen phone left unlocked at the OS level - uses ADB over USB or a pre-installed sideloaded application to send a direct intent to an improperly exported AppLock internal activity. The AppLock authentication screen is never displayed, and the attacker gains direct access to protected applications and their stored data.