EUVD-2026-21862
GHSA-5wcw-9q69-xf6p
Severity by source
CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker to bypass App Pinning.
AnalysisAI
Samsung Mobile's Recents application prior to SMR Apr-2026 Release 1 fails to properly validate exceptional conditions, allowing a physical attacker to bypass App Pinning security controls. The vulnerability requires physical device access and has a CVSS score of 4.1 reflecting the physical attack vector and confidentiality impact; no public exploit code or confirmed active exploitation has been identified.
Technical ContextAI
The vulnerability exists in Samsung Mobile's Recents application, a system component responsible for managing and displaying recently used applications. The flaw involves improper exception handling or validation logic that fails to enforce App Pinning restrictions-a Samsung security feature that prevents users from accessing pinned applications without authentication. The affected CPE spans Samsung Mobile devices running the vulnerable Recents component prior to the April 2026 Security Maintenance Release (SMR). The root cause involves a logical flaw in conditional checks rather than memory corruption or injection, consistent with an authentication bypass classification.
RemediationAI
Apply the Samsung Mobile Security Update for April 2026 Release 1 (SMR Apr-2026 Release 1) or later to patch the Recents application and restore App Pinning enforcement. Users should install the latest available SMR release on their Samsung Mobile devices through the standard system update mechanism. For devices in managed environments, administrators should enforce deployment of the patched SMR via mobile device management (MDM) policies. Users in multi-user or shared-device scenarios should prioritize this update to prevent unauthorized access to pinned applications. Detailed patching instructions and device-specific update paths are available via Samsung's security update portal at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=04.
More in Samsung Mobile Devices
View allOut-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of li
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimage
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
Memory corruption in Samsung's proprietary ImsService - the IP Multimedia Subsystem component handling VoLTE, Wi-Fi Call
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today