Samsung Health CVE-2026-21076

Exploitation requires local code execution on the target Samsung device, meaning the attacker must have a process running on the device - most realistically a co-installed malicious application. The CVSS 4.0 vector specifies PR:N, indicating no elevated privileges are required on the attacker side, so an unprivileged app can potentially exploit this without root or system-level access. Samsung Health must be installed and present on the device (versions prior to 7.0.0). No network access, no user interaction, and no special device configuration are required beyond having a vulnerable Samsung Health version installed alongside the malicious app. Exploitation is limited to the local attack surface - remote, unauthenticated, or over-network exploitation is not indicated by the available data.

The CVSS 4.0 score of 6.9 reflects a local-only attack vector, which inherently limits the population of potential attackers to processes or users already present on the device - a meaningful constraint that reduces real-world risk compared to a network-exploitable flaw of similar severity. The AV:L/PR:N combination is notable: local access is required, but no privileges are needed by the attacker, meaning a co-installed unprivileged malicious app could potentially trigger this. The confidentiality impact is rated High (VC:H), meaning successful exploitation could expose the full scope of health data stored or accessible by the application. There is no KEV listing, no known POC, and no EPSS data provided, so exploitation is currently assessed as opportunistic or theoretical. The combination of a large Samsung device install base and sensitive health data (which may include medical conditions, biometrics, and location) elevates the data-sensitivity dimension of risk even though the attack surface is local. No integrity or availability impact is indicated, consistent with a read-only information disclosure primitive.

A malicious application installed on the same Samsung device queries Samsung Health's exposed interface or content provider without holding the required authorization, bypassing the flawed access control check. The malicious app then reads sensitive health records - such as heart rate history, step counts, sleep data, or medical information - and exfiltrates them. No public exploit code has been identified at time of analysis.