Samsung Mobile EUVD-2026-26192

The attacker must have local access to the targeted Samsung Mobile Device running Android 14, 15, or 16 prior to SMR Mar-2026 Release 1. The CVSS 4.0 vector specifies PR:N, meaning no elevated Android permissions or special privileges are required beyond local device presence - a standard unprivileged app context may suffice. Exploitation is only meaningful against devices where installation restrictions are actively configured and enforced; without such restrictions in place, there is no policy to bypass and the practical impact is negligible. Remote exploitation is ruled out by the AV:L vector. SSVC's automatable: no designation indicates the attack cannot be trivially scripted for large-scale targeting, suggesting it requires deliberate, targeted effort against a specific device.

The CVSS 4.0 score of 6.9 with VI:H reflects meaningful integrity impact, but the local attack vector (AV:L) substantially constrains the exploitable population to attackers who already have device-level presence. EPSS is 0.00% at the 0th percentile - the lowest observable exploitation probability - and SSVC rates exploitation as none with automatable: no, confirming that no known active exploitation or mass-scalable attack path has been identified. KEV status is not confirmed. The CVSS 4.0 PR:N rating implies no special Android permissions are required beyond local presence, yet SSVC's automatable: no indicates this cannot be trivially scripted at scale, suggesting manual, targeted abuse. Real-world risk is concentrated in environments enforcing app installation restrictions through Samsung device MDM or parental controls; on devices without such restrictions actively configured, the exploitable impact is negligible. The intelligence tags include 'Information Disclosure,' which conflicts with the CVSS VI:H (integrity-only) rating and the description's focus on policy modification - this discrepancy is unexplained by available data and should be verified against the vendor advisory before classification decisions are made.

A local attacker - either with physical access to a Samsung device or operating through a malicious application already resident on the device - submits crafted data to PackageManagerService that passes the insufficient authenticity check, allowing the restriction policy for a specific application to be modified. This enables installation of an application that would otherwise be blocked by enterprise MDM policy or parental controls. No public proof-of-concept code has been identified at time of analysis.