CVE-2026-21131

Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.

Score

CVSS 4.0 2.1 Low

Status

Awaiting Analysis - mobile.security@samsung.com

Published

2026-10-12

Last modified

2026-10-15

Weaknesses

CWE-276

Affected products

• Samsung Flow (Samsung Mobile)

References

• https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=10