CVE-2026-21135
5.9MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-284
Impact
Local attackers can access sensitive browser information without requiring special privileges or user interaction. An attacker needs local access to the target device to exploit the flaw.
Root cause
Improper access control checks allow unauthorized local components to read sensitive data.
Affected systems
Samsung Internet prior to version 30.0.5.6
CVSS v4.0 · CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade Samsung Internet to version 30.0.5.6 or later via the Galaxy Store or Google Play Store. No workaround or interim mitigation is documented.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information.