CVE-2026-21118: Medium severity Samsung DownloadProvider vulnerability
Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SMR Oct-2026 Release 1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Devices using Samsung DownloadProvider before the SMR Oct-2026 Release 1 are affected. Exploitation requires local access and low-level privileges on the device.
What could an attacker gain through exploitation?
A local attacker could access files stored in scoped storage. The reported impact includes high confidentiality impact and low integrity and availability impact.
Does exploitation require user interaction or network access?
No user interaction is required. The attack vector is local, so it is not described as remotely exploitable over a network.
How can I remediate the issue?
Apply Samsung's SMR Oct-2026 Release 1 or a later security update that includes the fix.