CVE-2026-21020: Samsung Android Privilege Escalation Flaw

CVE-2026-21020 Overview

CVE-2026-21020 is a vulnerability in the OmaCP component of Samsung Android. The flaw stems from improper export of Android application components, which exposes privileged functionality to unauthorized callers on the device. A local attacker with the ability to run code on the device can invoke functions that should be restricted to privileged contexts. Samsung addressed the issue in the SMR (Security Maintenance Release) May-2026 Release 1 bulletin. The vulnerability affects Samsung Android 14.0, 15.0, and 16.0 across multiple prior SMR levels.

Critical Impact

A local attacker on an affected Samsung Android device can trigger privileged functions exposed by the OmaCP component, leading to limited compromise of confidentiality, integrity, and availability.

Affected Products

• Samsung Android 14.0 (releases prior to SMR May-2026 Release 1)
• Samsung Android 15.0 (releases prior to SMR May-2026 Release 1)
• Samsung Android 16.0 (releases prior to SMR May-2026 Release 1)

Discovery Timeline

• 2026-05-13 - CVE-2026-21020 published to NVD
• 2026-05-13 - Last updated in NVD database
• May 2026 - Samsung releases SMR May-2026 Release 1 addressing the issue, per the Samsung Security Update May 2026 advisory

Technical Details for CVE-2026-21020

Vulnerability Analysis

The vulnerability resides in OmaCP, Samsung's Open Mobile Alliance Client Provisioning component. OmaCP processes provisioning messages used to configure device settings such as APN, MMS, and browser parameters. The issue is classified as improper export of Android application components, mapped to NVD-CWE-Other in the NVD entry. Privileged functionality inside OmaCP is reachable by other applications on the device because the relevant components are exported without adequate permission gating. Local invocation by an unprivileged app or shell context can therefore trigger actions intended for system callers, producing limited but real impact on device configuration and state.

Root Cause

Android components such as activities, services, broadcast receivers, and content providers can be marked android:exported="true" or be implicitly exported by registering an intent filter. When an exported component performs privileged operations without enforcing a signature or signatureOrSystem permission, any local caller can reach it. In OmaCP prior to SMR May-2026 Release 1, one or more components fall into this category, allowing untrusted callers to drive privileged code paths inside a system-level provisioning app.

Attack Vector

Exploitation requires local access to the device, with no prior privileges and no user interaction. A malicious application installed on the device, or a process running through adb, can craft an Intent targeting the vulnerable OmaCP component and invoke its exposed methods. Because OmaCP runs with system-level capabilities for provisioning operations, the caller indirectly gains the ability to trigger privileged functions while remaining an unprivileged app itself. No verified proof-of-concept code has been published for this CVE.

Detection Methods for CVE-2026-21020

Indicators of Compromise

• Unexpected installation or invocation of applications targeting Samsung-specific com.android.omacp or related provisioning packages.
• Unauthorized changes to provisioning settings such as APN, MMS, or connectivity profiles on Samsung devices.
• Logcat entries showing intents from unprivileged UIDs delivered to OmaCP components.

Detection Strategies

• Enumerate installed applications on managed Samsung devices via MDM (Mobile Device Management) and flag non-store or sideloaded apps that request access to provisioning or messaging-related intents.
• Review Samsung Knox audit logs and Android system logs for anomalous interactions with OmaCP components by non-system UIDs.
• Use mobile threat defense (MTD) tooling to identify applications declaring intent filters or queries targeting com.android.omacp.

Monitoring Recommendations

• Track device security patch level via MDM and alert when devices report a Samsung SMR level older than May-2026 Release 1.
• Monitor for newly installed apps with broad permission sets or with explicit references to Samsung provisioning packages.
• Forward mobile telemetry into a centralized analytics or SIEM platform to correlate suspicious app behavior with device patch posture.

How to Mitigate CVE-2026-21020

Immediate Actions Required

• Apply the Samsung SMR May-2026 Release 1 update on all Samsung Android 14, 15, and 16 devices in the fleet.
• Enforce a minimum security patch level policy through MDM and quarantine devices that fall behind.
• Restrict sideloading and require installations from Google Play or Samsung Galaxy Store on managed devices.

Patch Information

Samsung published the fix in the May 2026 Security Maintenance Release. Refer to the Samsung Security Update May 2026 advisory for the per-model rollout. Devices reporting an Android security patch level of 2026-05-01 or later from Samsung include the corrected OmaCP component.

Workarounds

• Until the SMR May-2026 Release 1 update is available for a given model, limit the installation of third-party applications and disable adb debugging on production devices.
• Use MDM policies to restrict which applications can be installed and to block known-risky packages.
• Educate users to avoid installing apps from untrusted sources, as exploitation requires a local malicious app or shell access.

# Example MDM compliance check: require Samsung SMR May-2026 R1 or later
# Pseudocode for an MDM policy expression
require:
  vendor: samsung
  android_security_patch_level >= 2026-05-01
action_on_violation: quarantine_and_notify