EUVD-2026-55088
GHSA-9g4f-92vv-h6jp
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical access mandatory (AV:P), no prior privileges or user interaction required; confidentiality and integrity of app data fully compromised, availability unaffected, no scope change.
Primary rating from Vendor (SamsungMobile).
CVSS VectorVendor: SamsungMobile
Lifecycle Timeline
2DescriptionCVE.org
Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock function.
AnalysisAI
AppLock on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes improperly exported Android application components, enabling a physical attacker to bypass the app lock protection layer entirely. The flaw grants access to confidentiality- and integrity-sensitive data within locked applications without satisfying the intended authentication challenge. No public exploit is identified at time of analysis; exploitation is constrained to physical device access, limiting but not eliminating real-world risk for lost or stolen device scenarios.
Technical ContextAI
Android application components - activities, services, broadcast receivers, and content providers - can be declared as exported in an app's AndroidManifest.xml, making them invocable by external applications or direct ADB intents without the calling app holding the appropriate permission. AppLock is a Samsung-proprietary security layer that enforces a secondary credential gate (PIN, pattern, biometric) before permitting access to designated apps. When internal AppLock components are improperly exported, an adversary can invoke those components directly, bypassing the credential check entirely. This aligns with CWE-926 (Improper Export of Android Application Components), though Samsung did not formally assign a CWE for this entry. The affected CPE is cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:* with no version floor specified beyond the SMR Aug-2026 Release 1 boundary.
RemediationAI
Apply the Samsung Mobile Release (SMR) August 2026 Release 1 security update, which addresses this vulnerability per the vendor advisory at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=08. If immediate patching is not possible, users concerned about physical access scenarios should consider disabling AppLock and relying solely on the device's native screen lock with a strong PIN or passphrase, accepting the trade-off of reduced per-app granularity but eliminating the bypass surface. Enabling full-device encryption (enabled by default on modern Samsung devices) ensures that data at rest remains protected even if AppLock is bypassed on a powered-off device. Restricting ADB access via Developer Options (disable USB debugging) also raises the practical bar for component invocation attacks.
More in Samsung Mobile Devices
View allOut-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of li
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimage
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today