Samsung Account CVE-2026-21127

Requires a malicious or compromised application already present on the same Samsung device as the vulnerable Samsung Account package (below version 15.7.01.1); that local app abuses an Android component Samsung exported without adequate access control to read sensitive data. No remote access, no user interaction, and no elevated privileges are needed once a local app is running (PR:N/UI:N), but exploitation is fundamentally limited to local attackers - the adversary must first get code onto the device (e.g., via a sideloaded or store-delivered app), and the impact is read-only data disclosure with no integrity or availability effect. Affects default installations of the vulnerable versions; no special configuration is required.

This is a medium-severity local information-disclosure flaw (CVSS 4.0 base 6.9) in Samsung Account, where an improperly exported Android application component is reachable by other apps on the device. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) indicates local attack vector, low complexity, no privileges, and no user interaction, with impact confined to confidentiality (VC:H; VI:N/VA:N) - consistent with the description of reading sensitive data without the ability to modify it or affect availability. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The AV:L requirement is the dominant mitigating factor: an attacker must already have code running locally (typically a malicious or compromised app) on a Samsung device, which keeps this from being a remotely weaponizable, mass-exploitation issue despite PR:N. Net assessment: a genuine privacy/data-exposure risk worth patching on the vendor's monthly cadence, but not an emergency - it is a locally-scoped confidentiality bug, not a high-CVSS-but-network-exploitable critical. No conflicting signals were found between the vector and description; both point to local, unprivileged, confidentiality-only impact.

A user installs a seemingly benign third-party app from a store or sideloaded APK onto a Samsung device running Samsung Account below 15.7.01.1. Because a Samsung Account component is improperly exported, that app can bind to or invoke it with no special permission and read sensitive account-related data. No public proof-of-concept is referenced, and the low attack complexity (AC:L) means no timing or configuration race is needed once an app is present on the device.