EUVD-2026-55106
GHSA-425r-57mx-xgj9
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with low-privilege co-resident app, user interaction required to trigger the exported component, and high confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (SamsungMobile).
CVSS VectorVendor: SamsungMobile
Lifecycle Timeline
1DescriptionCVE.org
Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability.
AnalysisAI
SamsungPassAutofill prior to version 5.2.10.x on Samsung Android devices improperly exports application components, enabling a locally-installed malicious app to access sensitive autofill credential data with user interaction. The CVSS 4.0 vector (AV:L/PR:L/UI:A/VC:H) confirms the attack is constrained to on-device, low-privilege access requiring user-triggered activity, yielding a moderate score of 5.1 despite high confidentiality impact. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
Android application components - Activities, Services, Content Providers, and Broadcast Receivers - can be designated as exported, making them callable by other applications on the same device. SamsungPassAutofill, a Samsung proprietary autofill service pre-installed on Galaxy devices, improperly marks one or more of these components as exported, granting unprivileged third-party applications the ability to interact with them directly. This is a well-understood Android security anti-pattern; while no CWE is formally assigned by the reporter, the flaw maps conceptually to CWE-926 (Improper Export of Android Application Components). The CPE cpe:2.3:a:samsung_mobile:samsungpassautofill:*:*:*:*:*:*:*:* covers all versions of the component below 5.2.10.x. Because SamsungPassAutofill handles stored credentials and form-fill data, exposure of its components can yield high-value credential material.
RemediationAI
Update SamsungPassAutofill to version 5.2.10.x or later, delivered via Samsung's monthly security update or through the Galaxy Store. Consult the vendor advisory at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=08 for update instructions specific to your device model and region. If the system update cannot be applied immediately, the most effective compensating control is restricting the installation of untrusted third-party applications - since exploitation requires a malicious co-resident app, reducing the app install surface directly limits exposure. Enabling Google Play Protect scanning adds a secondary detection layer. These mitigations do not fix the underlying component export flaw and should be treated as temporary bridges to patching.
More in Samsung Mobile
View allLibQJpeg in the Samsung Galaxy S6 before the October 2015 MR allows remote attackers to cause a denial of service (memor
Out-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Race condition in the ioctl implementation in the Samsung Graphics 2D driver (aka /dev/fimg2d) in Samsung devices with A
The kbase_dispatch function in arm/t7xx/r5p0/mali_kbase_core_linux.c in the GPU driver on Samsung devices with M(6.0) an
Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
On Samsung mobile devices with M(6.0) and N(7.x) software, a heap overflow in the sensorhub binder service leads to code
On Samsung mobile devices with N(7.x) software, a buffer overflow in the vision service allows code execution in a privi
Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). Rated medium s
Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). Rated medium s
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today