CVE-2026-21059

Analyzed Analyzed - Analysis Complete

Improper Component Export in Samsung Contacts

Publication date: 2026-08-10

Last updated on: 2026-08-19

Assigner: Samsung Mobile

Description

Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-19

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-21059

EUVD

EUVD-2026-55084

Affected Vendors & Products

Vendor	Product	Version / Range
samsung	android	16.0
samsung	android	16.0
samsung	android	16.0
samsung	android	16.0
samsung	android	16.0
samsung	android	16.0
samsung	android	16.0
samsung	android	16.0
samsung	android	16.0
samsung	android	16.0
samsung	android	16.0
samsung	android	16.0
samsung	android	16.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-926	The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper export of Android application components in Samsung Contacts prior to the SMR Aug-2026 Release 1. It allows local attackers to delete files using Samsung Contacts' elevated privileges.

Detection Guidance

This vulnerability involves improper export of Android application components in Samsung Contacts. Detection requires checking if Samsung Contacts is installed and verifying its exported components. Use Android debug commands like 'adb shell dumpsys package com.sec.android.app.contacts' to inspect exported components. If any exported components are found without proper protection, the app may be vulnerable.

Impact Analysis

Local attackers could exploit this to delete files on your device that are accessible to Samsung Contacts, potentially causing data loss or disrupting functionality.

Compliance Impact

The vulnerability allows local attackers to delete files with Samsung Contacts' privilege, which could lead to unauthorized data deletion. This may impact compliance with GDPR (data integrity requirements) and HIPAA (integrity and availability of protected health information) if sensitive data is affected.

Mitigation Strategies

Update Samsung Contacts to the latest version from the SMR Aug-2026 Release 1 or later to address the improper export of application components.

Hi! I’m here to help you understand CVE-2026-21059. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70