CVE-2026-21131
2.1LowPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-276
Impact
A local attacker can launch arbitrary activities with Samsung Flow privileges on connected devices. They need local access on the device to trigger it.
Root cause
Incorrect default permissions allow unauthorized callers to start protected application activities.
Affected systems
Samsung Flow prior to version 4.9.22.4
CVSS v4.0 · CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Update Samsung Flow to version 4.9.22.4 or later via the Galaxy Store or Google Play Store; no interim workaround is documented.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.