VulnerabilityAwaiting Analysis

CVE-2026-21112

Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privilege.

MEDIUM 5.1EPSS 0.10%

Does this matter?

Lower severity and a low EPSS score (0.10%). Track it; it rarely justifies an emergency change on its own.

Description

Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privilege. User interaction is required for triggering this vulnerability.

CVSS 4.0: 5.1 MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.10% probability · 1th percentile
CISA KEV: Not listed
Weakness: CWE-20
Source: mobile.security@samsung.com

References

https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=09

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.