CVE-2026-20990: Secure Folder Privilege Escalation Flaw

CVE-2026-20990 Overview

CVE-2026-20990 is a high-severity vulnerability affecting Samsung's Secure Folder application on Android devices. The vulnerability stems from improper export of Android application components, which allows local attackers to launch arbitrary activities with Secure Folder privileges. This represents a significant security concern as Secure Folder is designed to be a protected, isolated environment for sensitive data and applications on Samsung devices.

Critical Impact

Local attackers can exploit improperly exported Android components to gain unauthorized access to Secure Folder privileges, potentially compromising sensitive user data stored within the protected environment.

Affected Products

• Samsung Secure Folder prior to SMR Mar-2026 Release 1
• Samsung Galaxy devices running vulnerable versions of Secure Folder
• Samsung Knox-enabled devices with affected Secure Folder implementations

Discovery Timeline

• 2026-03-16 - CVE-2026-20990 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-20990

Vulnerability Analysis

This vulnerability is classified as an Intent Redirection and Privilege Escalation issue within the Android application component architecture. The root of the problem lies in how Secure Folder exposes certain application components (Activities, Services, Broadcast Receivers, or Content Providers) through the Android manifest without proper access restrictions.

Android application components can be exported either explicitly via the android:exported="true" attribute or implicitly when intent filters are defined. When these components are improperly exported without adequate permission checks, they become accessible to any application on the device, regardless of its origin or trust level.

In this case, the exported components within Secure Folder can be invoked by malicious local applications to launch arbitrary activities with the elevated privileges associated with Secure Folder. This effectively bypasses the security isolation that Secure Folder is designed to provide.

Root Cause

The vulnerability originates from insufficient access control on exported Android application components within Secure Folder. The affected components lack proper permission declarations or signature-level protection that would restrict access to only authorized callers. This configuration oversight allows any local application to craft intents that target these components and execute actions within the Secure Folder context.

Attack Vector

The attack requires local access, meaning a malicious application must be installed on the target device. The attacker application can then construct explicit or implicit intents targeting the vulnerable exported components in Secure Folder. Upon successful exploitation, the attacker gains the ability to:

1. Launch arbitrary activities within the Secure Folder context
2. Potentially access protected data stored in Secure Folder
3. Execute operations with elevated privileges normally reserved for Secure Folder

The attack does not require user interaction beyond having the malicious application installed. The exploitation mechanism leverages Android's standard inter-process communication (IPC) capabilities, making detection challenging without specific monitoring for anomalous intent patterns.

Detection Methods for CVE-2026-20990

Indicators of Compromise

• Unexpected inter-process communication targeting Secure Folder components from non-Samsung applications
• Applications attempting to launch activities with com.samsung.knox.securefolder package identifiers
• Abnormal access patterns to Secure Folder protected storage or data
• Third-party applications requesting or utilizing intents targeting exported Secure Folder components

Detection Strategies

• Monitor for intent-based IPC calls targeting Secure Folder exported components from untrusted applications
• Implement application sandboxing solutions that can detect privilege escalation attempts
• Deploy mobile threat defense (MTD) solutions capable of identifying applications exploiting component export vulnerabilities
• Audit installed applications for suspicious intent filter declarations targeting Samsung Knox or Secure Folder

Monitoring Recommendations

• Enable detailed logging for Android IPC activities, particularly those involving protected applications
• Implement behavioral analysis to detect applications attempting to interact with Secure Folder outside normal usage patterns
• Deploy SentinelOne Mobile Threat Defense for real-time detection of privilege escalation attempts on mobile endpoints
• Review application permissions and component interactions during mobile security assessments

How to Mitigate CVE-2026-20990

Immediate Actions Required

• Update Samsung devices to SMR Mar-2026 Release 1 or later through Samsung's official update channels
• Review and remove any untrusted applications that may attempt to exploit this vulnerability
• Enable Samsung Knox security features for additional protection layers
• Deploy mobile device management (MDM) solutions to enforce security policies and patch compliance

Patch Information

Samsung has addressed this vulnerability in the SMR Mar-2026 Release 1 security update. The fix properly restricts access to previously exported components by implementing appropriate permission checks and component export configurations. Users should apply the security update through Settings > Software Update > Download and Install.

For detailed patch information, refer to the Samsung Mobile Security Update.

Workarounds

• Restrict installation of applications from unknown sources to minimize risk of malicious app installation
• Use Samsung Knox containerization features to add additional isolation layers
• Implement strict MDM policies that prevent sideloading of applications
• Temporarily disable or restrict access to Secure Folder until patches can be applied in high-risk environments
• Deploy SentinelOne Singularity Mobile to detect and prevent exploitation attempts in real-time

# ADB command to check Secure Folder version
adb shell dumpsys package com.samsung.knox.securefolder | grep versionName

# Verify SMR patch level on device
adb shell getprop ro.build.version.security_patch