Improper Access Control in DownloadProvider Affects Samsung Devices
CVE-2026-21118

6.9MEDIUM

Key Information:

Vendor

Samsung
Status
Samsung Devices
Vendor
CVE Published:
12 October 2026

What is CVE-2026-21118?

A vulnerability has been identified in Samsung's DownloadProvider, where improper access control allows local attackers to access files stored within scoped storage. This could lead to unauthorized access to sensitive data, potentially compromising user privacy and security. Users are advised to update their devices with the latest security patches to mitigate any risks associated with this vulnerability.

Affected Version(s)

Samsung Mobile Devices SMR Oct-2026 Release in Android 14, 15, 16, 17

References

https://security.samsungmobile.com/securityUpdate.smsb?ye...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.