Samsung Mobile Devices CVE-2026-21100

Exploitation requires a malicious application to be installed and locally executing on the target device. The device must run Android 14, 15, 16, or 17 with a SystemUI build prior to SMR Sep-2026 Release 1. The CVSS 4.0 vector specifies PR:N (no elevated privileges required) and UI:N (no user interaction), meaning any installed app - even one without special Android permissions - can trigger the flaw. Remote exploitation is categorically excluded given AV:L. The primary limiting factor is prior installation of a malicious application, which depends on the user accepting the app from an untrusted source or a separate social-engineering vector.

The CVSS 4.0 score of 6.9 (AV:L/AC:L/AT:N/PR:N/UI:N/VA:H) correctly identifies local-only access as the primary containment factor - this vulnerability is not remotely exploitable, and exploitation requires a malicious application to already be installed on the device. No public exploit code has been identified and the vulnerability is absent from CISA KEV, indicating no confirmed in-the-wild abuse. The official CVSS 4.0 impact assignment of VA:H with VI:N appears to understate the practical consequence: the ability to launch arbitrary Android activities across security boundaries can enable UI spoofing, security-prompt bypass, or unauthorized invocation of privileged components, all of which carry integrity implications beyond pure availability disruption. The 'Information Disclosure' tag in the provided metadata is inconsistent with both the vulnerability description and the CVSS vector (VC:N), pointing to a tagging error rather than an actual confidentiality impact. Overall risk priority is moderate - relevant for enterprise mobile device management environments managing large Samsung fleets, but not an emergency given the local attack vector and absence of active exploitation.

A malicious Android application installed on the victim's Samsung device invokes the improper access control path in SystemUI to launch an arbitrary activity - for example, a spoofed authentication prompt or lock-screen overlay - without holding the permissions normally required. This could be used to phish device credentials or bypass a security dialog the user would otherwise need to interact with. No public proof-of-concept exploit has been identified.