CVE-2026-21033

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Improper export of android application components in ExpressHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jun 5, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-210343.3Improper export of android application components in Samsung Auto prior to version 3.1.2.61 in Android 15 and 3.2.0.38 in Android 16 allows CVE-2026-210357.5Improper input validation in Samsung Plus TV prior to version 1.0.28.6 allows remote attackers to access sensitive information.CVE-2026-210365.5Improper authorization in Samsung Internet prior to version 30.0.0.39 allows local attackers to access sensitive information.CVE-2026-210377.1Improper input validation in Samsung Members prior to version 5.8.01.5 allows local attackers to access arbitrary URL and launch arbitrary aCVE-2026-210385.5Improper input validation in Samsung Android USB Driver for Windows prior to version 1.9.5.0 allows local attacker to access out-of-bounds mCVE-2026-210396.9Improper access control in Settings prior to SMR Jul-2026 Release 1 allows local attackers to configure Theft protection settings.CVE-2026-21044.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 CVE-2026-210406.9Improper access control in IAFDService prior to SMR Jul-2026 Release 1 allows local privileged attackers to use the privileged APIs.CVE-2026-210416.9Improper access control in SamsungSEAgentService prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information.CVE-2026-210428.7Out-of-bounds write in libsavsac.so prior to SMR Jul-2026 Release 1 allows remote attackers to execute arbitrary code.CVE-2026-210436.7Path traversal in Wallpaper service prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system server priCVE-2026-210445.8Improper authorization in KnoxGuardManager prior to SMR Jul-2026 Release 1 allows local attackers to bypass the persistence configuration of
CVE-2026-21033: High severity, CVSS 7.1 | Vulnix