SpriteWallpaper EUVD-2026-34798

Android applications declare their components - Activities, Services, Broadcast Receivers, and Content Providers - in the AndroidManifest.xml file. When a component is exported without proper permission enforcement (android:exported=true with no android:permission attribute or insufficient intent filter restrictions), any co-resident app or local attacker can invoke that component directly. This class of weakness is closely aligned with CWE-926 (Improper Export of Android Application Components), though Samsung's advisory lists CWE as N/A. The affected product is identified via CPE cpe:2.3:a:samsung_mobile:samsung_mobile_devices on Android 16 platforms. The CVSS 4.0 vector shows AV:L/AC:L/AT:N/PR:N/UI:N, meaning no elevated privilege or user interaction is needed for exploitation. Notably, the subsequent system impact metrics are all rated High (SC:H/SI:H/SA:H), indicating that the exported component can serve as a pivot point affecting broader system confidentiality, integrity, and availability beyond the app itself - consistent with a Content Provider or Service that bridges sensitive data across app boundaries.