EUVD-2026-55098
GHSA-wjjw-g477-w5j8
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical access vector and required user interaction (UI:R) dominate; high confidentiality with limited integrity and availability impact reflects activity launch primitives.
Primary rating from Vendor (SamsungMobile).
CVSS VectorVendor: SamsungMobile
Lifecycle Timeline
2DescriptionCVE.org
Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity.
AnalysisAI
Improper input validation in the Galaxy Themes application on Samsung Mobile Devices allows a physical attacker to launch arbitrary Android activities, with a high confidentiality impact on the vulnerable system. Affected devices are those running Galaxy Themes prior to the SMR Aug-2026 Release 1 security update. The vulnerability is tagged as an information disclosure issue, and while it requires physical device access and active user interaction, exploitation could allow access to sensitive device data or protected application screens that would otherwise be restricted. No public exploit has been identified at time of analysis, and no KEV listing exists.
Technical ContextAI
Galaxy Themes is a pre-installed Samsung application on Android-based Galaxy devices that manages and applies device themes. The vulnerability stems from improper input validation - the application fails to adequately sanitize or validate inputs used to trigger or navigate Android Activity components. In Android, an 'Activity' is a discrete UI screen or application component; launching an arbitrary one can bypass access controls, expose sensitive screens (e.g., contacts, gallery, settings), or invoke functionality without normal authentication gating. The CPE string (cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:*) covers all affected Samsung Mobile Devices prior to the August 2026 patch. No CWE was formally assigned, but the root cause class aligns conceptually with CWE-20 (Improper Input Validation) or CWE-284 (Improper Access Control) via activity export misuse.
RemediationAI
The primary fix is to apply the Samsung Security Maintenance Release for August 2026 (SMR Aug-2026 Release 1), which contains the corrected version of Galaxy Themes with proper input validation. Users should navigate to Settings > Software Update on their Samsung Galaxy device to apply the update. The vendor advisory is available at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=08. If the update cannot be applied immediately, a compensating control is to ensure the device screen lock is enabled with a strong PIN or biometric, which raises the bar for physical access attacks by requiring active user interaction to reach the exploitable code path. Restricting physical access to the device itself is the most effective interim measure given the AV:P attack vector. No other vendor-documented workarounds were identified in available references.
More in Samsung Mobile Devices
View allOut-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of li
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimage
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
Memory corruption in Samsung's proprietary ImsService - the IP Multimedia Subsystem component handling VoLTE, Wi-Fi Call
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today