EUVD-2026-74650
GHSA-v896-w4v4-33cj
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only vector; AC:H reflects the AT:P prerequisite condition; PR:N per vendor 4.0 vector; only low confidentiality impact, no integrity or availability.
Primary rating from Vendor (SamsungMobile).
CVSS VectorVendor: SamsungMobile
Lifecycle Timeline
2DescriptionCVE.org
Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information.
AnalysisAI
Local information disclosure in Samsung Mobile's Watch Plugin for Android allows attackers with physical or local software access to read sensitive data from the device. Affected versions are all Watch Plugin releases prior to the Android Watch 17 patch, as confirmed by the Samsung Mobile security advisory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access to the Android device running a vulnerable version of Watch Plugin (prior to Android Watch 17 patch). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 2.1 (AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N) is consistent with real-world risk here: attack vector is strictly local, the only impact is low confidentiality disclosure, and specific attack prerequisites (AT:P) further constrain exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Samsung Watch Plugin to the version bundled with or released alongside Android Watch 17, as specified in the Samsung Mobile security bulletin at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=09. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Samsung Mobile
View allLibQJpeg in the Samsung Galaxy S6 before the October 2015 MR allows remote attackers to cause a denial of service (memor
Out-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Race condition in the ioctl implementation in the Samsung Graphics 2D driver (aka /dev/fimg2d) in Samsung devices with A
The kbase_dispatch function in arm/t7xx/r5p0/mali_kbase_core_linux.c in the GPU driver on Samsung devices with M(6.0) an
Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
On Samsung mobile devices with M(6.0) and N(7.x) software, a heap overflow in the sensorhub binder service leads to code
On Samsung mobile devices with N(7.x) software, a buffer overflow in the vision service allows code execution in a privi
Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). Rated medium s
Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). Rated medium s
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today