Samsung DownloadProvider CVE-2026-21118

Requires a locally installed, attacker-controlled Android application (PR:L) running on a Samsung device with firmware prior to SMR Oct-2026 Release 1; the app abuses DownloadProvider's improper access control to reach files in scoped storage it should not access. No user interaction and no network access are involved (AV:L/UI:N). Exploitation is LIMITED by the need to first get an app onto the target device and by the local-only vector - it cannot be triggered remotely and does not work against patched (SMR Oct-2026 Release 1 or later) firmware.

This is a moderate-risk, locally-exploitable information disclosure flaw rather than a top-tier emergency. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L) scores 6.9 and consistently points to a local attack requiring low privileges - i.e., an already-installed malicious app on a Samsung Android device - with no user interaction and high confidentiality impact. No EPSS score was supplied, and there is no KEV listing and no public exploit identified at time of analysis, so there is no evidence of active exploitation or weaponization. The signals do not conflict: the local attack vector and PR:L requirement inherently cap real-world risk because an attacker must first get an app onto the device, which limits mass or remote exploitation. Note that EPSS, CWE, and any POC data are MISSING from the input, so exploitation-probability cannot be quantified - treat the 'no public exploit' finding as absence-of-evidence from a single vendor source, not a guarantee.

A user installs a malicious or over-permissioned app on a Samsung device running firmware prior to SMR Oct-2026 Release 1. That app abuses improper access control in DownloadProvider to read files in scoped storage belonging to other apps or the user, bypassing Android's storage isolation. No public exploit code was identified at time of analysis, and exploitation requires only local app-level privileges with no user interaction.