CVE-2026-21081

Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability.

CVSS

No CVSS.

References

Link	Resource
https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=08

Configurations

No configuration.

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Exportación indebida de componentes de aplicación de Android en SamsungPassAutofill anterior a la versión 5.2.10.x permite a atacantes locales acceder a información sensible. Se requiere interacción del usuario para desencadenar esta vulnerabilidad.

Information

Published : 2026-08-10 09:17

Updated : 2026-10-23 20:10

NVD link : CVE-2026-21081

Mitre link : CVE-2026-21081

CVE.ORG link : CVE-2026-21081

JSON object : View

Products Affected

No product.

CWE

CWE-926

Improper Export of Android Application Components

{"id": "CVE-2026-21081", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21081", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T17:31:42.336401Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "mobile.security@samsung.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "mobile.security@samsung.com", "affectedData": [{"vendor": "Samsung Mobile", "product": "SamsungPassAutofill", "versions": [{"status": "unaffected", "version": "5.2.10.x", "lessThan": "*", "versionType": "semver"}], "defaultStatus": "affected"}]}], "published": "2026-08-10T09:17:21.803", "references": [{"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=08", "source": "mobile.security@samsung.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-926"}]}], "descriptions": [{"lang": "en", "value": "Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability."}, {"lang": "es", "value": "Exportaci\u00f3n indebida de componentes de aplicaci\u00f3n de Android en SamsungPassAutofill anterior a la versi\u00f3n 5.2.10.x permite a atacantes locales acceder a informaci\u00f3n sensible. Se requiere interacci\u00f3n del usuario para desencadenar esta vulnerabilidad."}], "lastModified": "2026-10-23T20:10:00.160", "sourceIdentifier": "mobile.security@samsung.com"}