Samsung Internet up to 29.0.0.48 improper authorization

Summaryinfo

A vulnerability classified as critical has been found in Samsung Internet. The affected element is an unknown function. Performing a manipulation results in improper authorization. This vulnerability was named CVE-2026-21036. The attack needs to be approached locally. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Samsung Internet. This affects some unknown processing. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Improper authorization in Samsung Internet prior to version 30.0.0.39 allows local attackers to access sensitive information.

The advisory is shared at security.samsungmobile.com. This vulnerability is uniquely identified as CVE-2026-21036 since 12/11/2025. The exploitability is told to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

Upgrading to version 30.0.0.39 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-34808). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Samsung

Name

• Internet

Version

• 5.0.9
• 6.2.01.12
• 6.4.0.15
• 13.0.1.60
• 13.2.1.46
• 13.2.1.70
• 14.0.1.20
• 14.0.1.62
• 15.0.2.47
• 16.0.2
• 16.0.2.19
• 16.0.6.23
• 16.2.1
• 17.0.1.69
• 17.0.7.34
• 18.0.4.14
• 21.0.0.41
• 22.0.0.35
• 24.0
• 24.0.0.0
• 24.0.0.41
• 24.0.3.2
• 25.0.0.41
• 26.0.3.1
• 28.0.0.59
• 29.0.0.48

License

• commercial

Website

• Vendor: https://www.samsung.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion