CVE-2026-21036: Samsung Internet Authorization Flaw Exposes Sensitive Data

Technical summary

CVE-2026-21036 stems from improper authorization controls (CWE-863) in Samsung Internet's access logic. An authenticated local user can bypass intended permission boundaries to access sensitive data. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects that exploitation requires local access and low-level privileges, but once initiated, high-impact confidential information becomes readable without user interaction. The attack does not cross security boundaries or affect system availability.

Business impact

This vulnerability poses a localized but meaningful confidentiality risk, particularly in shared-device or multi-user environments. An employee or household member with device access could extract browser-stored credentials, cached data, or other sensitive information without triggering alerts. In enterprise contexts, BYOD programs and shared kiosks increase exposure. Data breach scope is limited by the attacker's local access, but customer data, authentication tokens, or proprietary information could be compromised.

Affected systems

Samsung Internet versions prior to 30.0.0.39 are affected. This applies to Samsung devices running the company's native browser. Organizations should audit which devices in their fleet run Samsung Internet and determine their version status. Note that Samsung Internet is also available on non-Samsung Android devices, so the scope is broader than just Samsung-branded phones and tablets.

Exploitability

Exploitation is straightforward once local access is obtained; no complex steps, chaining, or user interaction is required. However, the attacker must already have logical access to the device (e.g., physical possession, shared account, or compromised local account). This reduces real-world risk in single-user, personal-device scenarios but increases it in corporate lab environments, shared workstations, or multi-user households. The vulnerability is not currently tracked in the CISA KEV catalog.

Remediation

Upgrade Samsung Internet to version 30.0.0.39 or later. This patch enforces proper authorization checks before allowing access to sensitive data. Users should check for app updates through the Samsung Galaxy Store or Google Play Store. Organizations should validate the update against vendor documentation to confirm the patched version is available for their device models.

Patch guidance

Samsung users can update Samsung Internet via automatic app updates through their store (Galaxy Store preferred for Samsung devices) or by manually checking for updates within the app settings. Verify the updated version number displays as 30.0.0.39 or higher after installation. For enterprise deployments, consider push delivery through mobile device management (MDM) solutions if available. Validate the patch against Samsung's official security bulletin to confirm the fix applies to all affected device SKUs.

Detection guidance

Monitor Samsung Internet version numbers across your device inventory using MDM or asset management tools. Look for any instances running versions below 30.0.0.39. Since this is a local authorization flaw with no network signature, endpoint detection is difficult; focus on inventory and update compliance. If you suspect unauthorized data access on a Samsung device, examine browser cache, cookies, and stored secrets for unexpected exfiltration or tampering.

Why prioritize this

A CVSS 5.5 MEDIUM severity score reflects the limited attack surface (local-only) but high confidentiality impact. Prioritize based on device criticality and sharing patterns: high-risk environments include shared corporate devices, lab machines, and kiosks where multiple users access the same Samsung device. Personal and single-user deployments are lower risk but should still be patched in a routine cycle.

Risk score, explained

The CVSS 5.5 reflects balanced concern: the confidentiality impact is high (C:H), but the attack vector is local and requires existing privileges (AV:L, PR:L), limiting the pool of potential attackers. Integrity and availability are unaffected (I:N, A:N). For organizations with strict multi-user device controls, the risk may trend lower; for those with permissive sharing or BYOD policies, operational risk can exceed the base CVSS score.

Frequently asked questions