CVE-2026-21060: Samsung Contacts Information Disclosure

CVE-2026-21060 Overview

CVE-2026-21060 is an improper input validation vulnerability [CWE-20] in Samsung Contacts. The flaw affects versions prior to the Samsung Maintenance Release (SMR) August 2026 Release 1. An attacker with physical access to the device can bypass user profile boundaries and read contact data belonging to other profiles on the same device.

The vulnerability received a CVSS 4.0 base score of 6.7, categorized as MEDIUM severity. The attack vector is physical, which limits remote exploitation but remains relevant for lost, stolen, or shared devices. Samsung addressed the issue in its August 2026 mobile security bulletin.

Critical Impact
A physical attacker can access contact data across multiple user profiles on an affected Samsung device, breaking the isolation model that separates work, personal, and secondary user data.

Affected Products

Samsung Contacts application on Samsung mobile devices
Samsung devices running firmware prior to SMR Aug-2026 Release 1
Samsung devices configured with multiple user profiles (Secure Folder, work profile, or secondary users)

Discovery Timeline

2026-08-10 - CVE-2026-21060 published to the National Vulnerability Database (NVD)
2026-08-10 - Samsung publishes August 2026 mobile security update addressing the issue
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-21060

Vulnerability Analysis

The Samsung Contacts application fails to properly validate input parameters used when resolving which user profile owns a given contact record. On Android, each user profile maintains a separate ContentProvider namespace and contact database. Proper enforcement requires the application to validate the profile identifier and cross-check it against the caller's user context before returning records.

Because validation is missing or incomplete, an attacker with physical access can craft queries or navigate the Contacts UI in a way that causes the application to load records from a profile other than the currently active one. The result is unauthorized disclosure of contact data belonging to secondary users, work profiles, or Secure Folder instances.

The issue is classified under Improper Input Validation [CWE-20]. Exploitation requires no privileges and no user interaction beyond the attacker's own actions on the device.

Root Cause

The root cause is a missing validation step in the Contacts application's data access path. The application accepts a profile or user identifier without confirming that the requesting caller is authorized to access that identifier. This breaks the trust boundary that Android's multi-user framework enforces at the platform layer.

Attack Vector

The attack requires physical possession of an unlocked or partially accessible Samsung device. The attacker interacts with the Contacts application locally to trigger the flawed code path. Remote exploitation is not possible. Successful exploitation exposes contact data confidentiality but does not modify data or affect availability.

No verified proof-of-concept code has been published. See the Samsung Mobile Security Update for vendor technical details.

Detection Methods for CVE-2026-21060

Indicators of Compromise

Unexpected access to the Contacts application during periods when the device owner was not using it
Contact records appearing in a profile where they were not created or synced
Device logs showing Contacts queries that reference user or profile identifiers outside the active session

Detection Strategies

Audit Samsung device firmware versions and confirm the SMR patch level is August 2026 Release 1 or later across the mobile fleet
Use mobile device management (MDM) inventory reports to identify unpatched devices with multiple profiles configured
Review physical access controls and device custody logs for shared or high-risk devices

Monitoring Recommendations

Track SMR patch level compliance in enterprise mobility dashboards
Alert on devices that miss the August 2026 or later Samsung security patch level
Correlate physical access events, such as help desk handoffs or repairs, with device patch status

How to Mitigate CVE-2026-21060

Immediate Actions Required

Install the Samsung Maintenance Release SMR Aug-2026 Release 1 or a later firmware update on all affected devices
Enforce strong screen lock policies, including biometric plus PIN or password, to raise the bar for physical attackers
Restrict use of multiple user profiles or Secure Folder on high-risk devices until patched

Patch Information

Samsung addressed CVE-2026-21060 in the August 2026 mobile security update. Administrators should push the SMR Aug-2026 Release 1 or later through carrier updates, MDM, or manual OTA delivery. Refer to the Samsung Mobile Security Update for firmware availability by device model.

Workarounds

Disable secondary user profiles and Secure Folder on unpatched devices that store sensitive contact data
Require devices to remain locked when unattended and shorten screen lock timeout values
Physically secure devices and prohibit sharing of unpatched Samsung devices between users with different data sensitivity levels

bash

# Verify Samsung security patch level on a connected device via adb
adb shell getprop ro.build.version.security_patch
# Expected output: 2026-08-01 or later