SamsungPassAutofill CVE-2026-21081

Exploitation requires a malicious application to be installed on the same Samsung Android device running a vulnerable version of SamsungPassAutofill (prior to 5.2.10.x). The attacker app operates at low privilege (standard Android app sandbox), consistent with PR:L in the CVSS vector. Critically, active user interaction is required - UI:A in the CVSS 4.0 vector confirms the vulnerability cannot be triggered silently or passively; the victim must perform some foreground action, likely involving the autofill subsystem. Remote exploitation is impossible per AV:L. The vulnerability does not affect non-Samsung Android devices, as SamsungPassAutofill is a Samsung-specific pre-installed component. Non-default configurations are not a prerequisite - the flaw exists in the default installation state of the affected versions.

The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N captures the core risk profile: local-only attack, low attacker privilege (a co-resident app), mandatory user interaction, and high confidentiality impact confined to the vulnerable system. The score of 5.1 accurately reflects the significant limiting factors - an attacker cannot exploit this remotely, must have already placed a malicious app on the device, and must induce the victim to perform some action. There is no KEV listing and no EPSS data is available, suggesting no observed mass exploitation. The real-world priority is moderate: devices used by high-value targets (executives, journalists) with untrusted apps installed represent a credible threat, but opportunistic mass exploitation is unlikely given the prerequisites. The high VC metric is the most consequential signal - autofill credential stores can contain passwords across many services, making even a single successful extraction disproportionately impactful.

A threat actor distributes a malicious Android application - potentially disguised as a utility or game - that, once installed on a victim's Samsung Galaxy device, invokes the improperly exported SamsungPassAutofill component. When the victim performs an autofill-related action (such as tapping a login form), the malicious app intercepts or queries the exposed component to extract stored credentials. No public exploit code has been identified at time of analysis, so this scenario currently requires custom tooling.