Samsung Flow CVE-2026-21131

Exploitation requires local access to a device running Samsung Flow prior to version 4.9.22.4 that is actively paired/connected to another device, plus the attack requirements indicated by AT:P in the CVSS 4.0 vector (a specific pairing/connection state must exist). The flaw stems from an incorrect default permission that lets a local attacker launch an arbitrary activity with Samsung Flow's privileges. Limiting factors: the attacker must already be local (AV:L), an active Samsung Flow connection to the target device must be established, and the condition-dependent attack requirement (AT:P) means exploitation is not reliable against arbitrary unpaired devices; impact is bounded to the connected system with low confidentiality/integrity effect only.

This is a genuinely low-priority issue, and the signals are consistent in pointing that way. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:N) scores just 2.1, reflecting that an attacker must already have local access to the device and that specific attack requirements (AT:P) must be met for exploitation to succeed. Impact is confined to the subsequent (connected) system with only low confidentiality and integrity effect (SC:L/SI:L) and no impact on the vulnerable system itself or on availability. There is no EPSS score provided, no CISA KEV listing, and no public proof-of-concept - so exploitation probability signals are absent rather than contradictory. No SSVC decision data was supplied. One minor tension worth noting: the issue is tagged 'Information Disclosure,' but the description describes launching an arbitrary activity with Samsung Flow privileges, which is an improper-access-control / privilege issue rather than pure data disclosure; the low SC/SI impact is consistent with limited incidental disclosure. Overall this is a low-severity local privilege/access flaw, not a widespread remote-exploitation priority.

A local attacker with code execution or an installed malicious app on a device paired via Samsung Flow leverages an incorrect default permission to launch an arbitrary activity that runs with Samsung Flow's privileges on the connected device. Because the attack is local and subject to specific attack requirements (AT:P), it requires the attacker to already be present on or adjacent to the paired device. No public exploit code has been identified at time of analysis.