CVE-2026-21081: Samsung Pass Autofill Disclosure Flaw

CVE-2026-21081 is an information disclosure vulnerability in Samsung Pass Autofill caused by improper export of Android components. Local attackers can access sensitive data with user interaction. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-21081 Overview

CVE-2026-21081 is a medium-severity vulnerability in Samsung's SamsungPassAutofill application on Android. The flaw stems from improper export of application components [CWE-926], allowing local attackers to access sensitive information handled by the autofill service. Successful exploitation requires user interaction, which limits the attack surface but does not eliminate risk on shared or compromised devices. Samsung addressed the issue in SamsungPassAutofill version 5.2.10.x. The vulnerability was disclosed in the Samsung Mobile Security Bulletin for August 2026.

Critical Impact
A locally installed malicious application can leverage the exported component to retrieve confidential data managed by Samsung Pass, including credentials cached for autofill operations.

Affected Products

Samsung SamsungPassAutofill versions prior to 5.2.10.x
Samsung Galaxy devices running affected SamsungPassAutofill builds
Android environments where SamsungPassAutofill provides autofill services

Discovery Timeline

2026-08-10 - CVE-2026-21081 published to NVD via the Samsung Mobile Security Bulletin
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-21081

Vulnerability Analysis

The vulnerability resides in the way SamsungPassAutofill declares one or more Android application components. Improperly exported components, tracked as [CWE-926], become reachable by any third-party application on the device through standard Android Intent mechanisms. When the exposed component handles sensitive autofill data, other installed apps can query it or trigger flows that leak that data. The autofill service manages credentials, payment fields, and personal details, so unauthorized access has direct confidentiality impact. Exploitation is bounded by the local attack vector and a required user interaction step, meaning the attacker must already have code running on the device and coerce the user into approving or triggering an action. The scope of impact is confined to the SamsungPassAutofill process boundary, with no reported integrity or availability effects.

Root Cause

The root cause is a manifest-level misconfiguration where a component is either explicitly exported or implicitly exported by declaring an intent filter without the android:exported="false" attribute. This exposes an internal interface intended only for the SamsungPass process to arbitrary callers on the same device.

Attack Vector

A malicious application installed on the same Android device sends a crafted Intent to the exported SamsungPassAutofill component. The user is then prompted to interact with an autofill flow, and the malicious app harvests the resulting sensitive data. No elevated privileges beyond a normal installed app are required.

No public proof-of-concept exploit is available for CVE-2026-21081. Refer to the Samsung Mobile Security Bulletin for vendor technical details.

Detection Methods for CVE-2026-21081

Indicators of Compromise

Presence of SamsungPassAutofill versions earlier than 5.2.10.x on managed Android devices
Third-party applications issuing Intents targeting SamsungPassAutofill package components
Unexpected autofill prompts appearing when non-browser or non-form applications are in the foreground

Detection Strategies

Enumerate installed Samsung Pass package versions across the mobile fleet using MDM inventory queries
Inspect application manifests via static analysis tools such as apktool or MobSF to identify components with android:exported="true" that access Samsung Pass APIs
Monitor Android system logs for ActivityManager entries showing cross-package Intent delivery to SamsungPassAutofill components

Monitoring Recommendations

Ingest MDM and mobile threat defense telemetry to flag devices running vulnerable SamsungPassAutofill builds
Alert on installation of newly sideloaded applications on devices that also host Samsung Pass
Review Google Play Protect and Samsung Knox alerts for applications flagged as attempting cross-app data access

How to Mitigate CVE-2026-21081

Immediate Actions Required

Update SamsungPassAutofill to version 5.2.10.x or later through the Galaxy Store
Apply the Samsung security patch level associated with the August 2026 Samsung Mobile Security Bulletin
Audit installed third-party applications on affected devices and remove untrusted apps

Patch Information

Samsung fixed the improper component export in SamsungPassAutofill 5.2.10.x. The fix is delivered through the Galaxy Store and referenced in the Samsung Mobile Security Bulletin for August 2026. Enterprise fleets should enforce the update through their mobile device management platform.

Workarounds

Restrict installation of untrusted applications on devices where Samsung Pass autofill is enabled
Disable SamsungPassAutofill as the default autofill service until the update is applied via Settings > General management > Passwords and autofill
Enforce MDM policies that block sideloading and require Google Play Protect to remain active

bash

# Verify installed SamsungPassAutofill version via ADB
adb shell dumpsys package com.samsung.android.samsungpassautofill | grep versionName