CVE-2026-21060

CVE-2026-21060 in Samsung's Contacts app allows a physically-present attacker to access contacts from a different profile (work or personal) than the one they're currently authenticated to. The CVSS 6.7 rating reflects the physical-access prerequisite, but don't let that undersell the impact — cross-profile contact leakage breaks Android's fundamental work/personal separation guarantee, exposing the very boundary multi-profile architecture is designed to enforce. The root cause isn't simple input validation failure in the traditional sense. Samsung's Contacts app had to thread profile context through every data path when handling contact queries — and somewhere in that implementation, some code path bypassed the framework's profile-aware query layer entirely, either by using direct database URIs or by caching contact references outside the profile-scoped ContentProvider lifecycle. This is a recurring failure pattern: developers reach for a simpler but unsafe shortcut when the correct ContactsContract API (flags like CONTACT_LOOKUP with CURRENT profile selection) was available. The bug likely wasn't written as 'skip validation here' — it was correct code that became dangerous when profile-switching features were added on top, and the original assumptions about profile isolation were never re-examined at every entry point. For Samsung device owners: the August 2026 SMR patch addresses this. If you're on an older monthly security patch level, treat this as a priority update regardless of the medium-severity CVSS score. For developers working with Android multi-profile architectures: audit every entry point where data could cross profile boundaries — not just where user input is processed, but where data is fetched, cached, or passed between components. The ContactsContract API provides profile-aware querying mechanisms; the failure mode here was almost certainly bypassing them. Treat profile-context threading as a first-class security requirement, not an implementation detail. This pattern has appeared in calendar apps and dialers — it's a known failure class, not a novel complexity.

Reviewed through automated stages and approved by a human before publication.