Samsung Galaxy Themes CVE-2026-21073

Physical access to the Samsung Galaxy device is the primary prerequisite, as mandated by the CVSS 4.0 AV:P metric. Active user interaction (UI:A) is additionally required, meaning the exploitation cannot occur against a completely idle or locked-out device without some form of victim participation - this may mean the device must be in an active or recently active state. No privileges are required on the device itself (PR:N in the CVSS 4.0 vector), suggesting the Galaxy Themes application exposes the vulnerable code path to any physical operator. Exploitation is limited to devices running Galaxy Themes prior to SMR Aug-2026 Release 1. Remote, network-based, or unauthenticated remote exploitation is explicitly ruled out by the physical attack vector. The non-default condition that constrains exploitation is physical proximity combined with active device interaction - purely remote or automated mass exploitation is not possible.

The CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L) reflects a physical-access-only scenario with no network exploitation path, which significantly limits the real-world attack surface. EPSS data was not provided, but the physical vector places this firmly in the low-opportunistic-exploitation tier - mass automated attacks are not feasible. The high confidentiality impact (VC:H) is the most concerning signal, suggesting a successful exploit could expose sensitive personal data. Integrity and availability impacts are low. No CISA KEV listing and no public exploit code identified, further supporting low immediate threat elevation. The UI:A requirement (active user interaction) adds an additional constraint. Despite the elevated CVSS 4.0 score of 5.2, this is a realistic priority only for threat models involving targeted physical access attacks - e.g., device theft, border crossing, or law enforcement contexts - rather than broad enterprise or remote threats. The score of 5.2 is moderate and accurately reflects the bounded physical attack surface.

An attacker gains brief physical access to an unattended or recently unlocked Samsung Galaxy device - for example, a device left on a desk or seized during theft. While the device is accessible and user interaction occurs (satisfying the UI:A requirement), the attacker interacts with the Galaxy Themes application in a way that provides malformed input, triggering the improper validation flaw and launching an arbitrary Android activity. This could expose sensitive screens such as contacts, photo galleries, or account credentials without requiring the device PIN or biometric authentication. No public exploit code has been identified at time of analysis.