CVE-2026-21127
6.9MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-926
Impact
A local attacker or malicious app on the device can access sensitive data without requiring credentials. They only need local execution access on the device.
Root cause
Improper export of Android application components exposes internal app interfaces to other applications.
Affected systems
Samsung Account prior to version 15.7.01.1
CVSS v4.0 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade Samsung Account to version 15.7.01.1 or later via the Galaxy Store. No interim workaround is documented.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data.