Samsung Watch Plugin CVE-2026-21109

Requires local access to the Android device running a vulnerable version of Watch Plugin (prior to Android Watch 17 patch). The CVSS 4.0 AT:P metric confirms that beyond local access, specific attack prerequisites or environmental conditions must be satisfied - the exact prerequisite is not disclosed in the Samsung advisory or NVD entry. Exploitation is limited strictly to low confidentiality impact (VC:L); no integrity or availability impact exists. Remote exploitation is not possible (AV:L). No authentication is required once local access and the AT:P condition are met (PR:N). This limits realistic risk to scenarios involving physical device access or a co-resident malicious application on the same device.

The CVSS 4.0 base score of 2.1 (AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N) is consistent with real-world risk here: attack vector is strictly local, the only impact is low confidentiality disclosure, and specific attack prerequisites (AT:P) further constrain exploitability. There is no KEV listing, no public exploit, and EPSS data is not provided. The PR:N metric in CVSS 4.0 indicates no privileges are required on the device to trigger the access control bypass, which is the primary risk amplifier. However, the combination of local-only access, low confidentiality ceiling, and prerequisite conditions keeps this firmly in the low-severity tier. No CVSS 3.x vector is provided by the vendor; the 4.0 vector is the authoritative scoring signal. This is not a prioritization target for most enterprise security teams unless they have a large managed Android-device fleet with Samsung wearable deployments.

An attacker with local access to an Android device - whether through physical possession, a malicious co-installed application with local IPC access, or an unlocked device - exploits the missing or insufficient access control in Watch Plugin to read sensitive information (such as health data, notification history, or device configuration) that should be restricted. The AT:P prerequisite condition means some additional device state or configuration must be present for exploitation; what exactly triggers that condition is not specified in the available advisory.