EUVD-2026-55084
GHSA-pgp3-v5mx-qq76
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector because exploitation requires an installed app; PR:N because the exported component is reachable without any permissions; only integrity impacted via file deletion.
Primary rating from Vendor (SamsungMobile).
CVSS VectorVendor: SamsungMobile
Lifecycle Timeline
2DescriptionCVE.org
Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege.
AnalysisAI
Unauthorized file deletion via improperly exported Android components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows any locally-installed malicious application to invoke the exported component and delete files under Samsung Contacts' privilege without requiring any elevated permissions of its own. The vulnerability stems from an Android component export misconfiguration, granting third-party apps unintended access to privileged file operations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of privilege requirements make this straightforward to exploit on affected devices.
Technical ContextAI
Android application components - Activities, Services, BroadcastReceivers, and ContentProviders - can be marked as exported in the AndroidManifest.xml, making them accessible to other installed applications on the device. When exported without proper permission enforcement (e.g., a custom signature-level permission or an android:permission attribute), any app on the device can invoke that component. In this case, Samsung Contacts exposes a component that performs file deletion operations using the Contacts application's own UID privileges, which may include access to the Contacts storage sandbox and potentially shared storage paths. The affected CPE is cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:*, covering Samsung Mobile Devices broadly. CWE classification was not provided by the reporter, but the root cause aligns with CWE-926 (Improper Export of Android Application Components).
RemediationAI
The primary fix is to apply Samsung's SMR Aug-2026 Release 1 security update, which patches the improperly exported component in Samsung Contacts. Users and enterprise MDM administrators should ensure Samsung devices are updated to the August 2026 Samsung security patch level. The vendor advisory is available at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=08. As a compensating control prior to patching, restricting device installation to trusted app sources (enabling Google Play Protect, disabling 'Install unknown apps') reduces the attack surface by limiting an adversary's ability to deploy a malicious triggering application. Enterprise environments using MDM can enforce application allowlisting to prevent unauthorized apps from being installed, which would block the prerequisite for exploitation. These controls carry the trade-off of reduced user flexibility but meaningfully limit the exposure window.
More in Samsung Mobile Devices
View allOut-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of li
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimage
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
Memory corruption in Samsung's proprietary ImsService - the IP Multimedia Subsystem component handling VoLTE, Wi-Fi Call
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today