CVE-2026-21081

CVE-2026-21081 is an exported component vulnerability in SamsungPassAutofill, the Android autofill service that stores and supplies credentials across apps. The issue is that one or more components within SamsungPassAutofill were exported without sufficient access controls, allowing any installed application on the device to query the autofill service for stored credentials without the user re-authorizing each request. This is not a permissions bypass in the traditional sense — the user already granted SamsungPassAutofill autofill permissions, which Android surfaces as a security-relevant decision. The exported component silently undermines that boundary at the component level, a distinction invisible to users and undetectable without specialized tooling. The CVSS 5.1 score significantly understates the actual risk. The metric treats user interaction as friction between attacker and exploit, but here the user interaction — granting autofill access — is the trust relationship itself. When a user deliberately enables SamsungPassAutofill, they are self-selecting as a high-value target. Compromising this single service doesn't yield one credential; it yields the master key to every autofill-enabled app on the device, potentially dozens of banking, email, and social applications. The blast radius of a credential-handler compromise dwarfs that of a complex RCE in a single-purpose utility. This is also not an isolated coding error. The autofill service architecture forces developers to export components to function as a system-wide service, while the permission model creates a false semantic boundary that users and developers both rely on incorrectly. The autofill permission appears to establish a protected credential handling zone, but improper exports inside the app quietly bypass that zone at the component level. This pattern has recurred across multiple vendors and CVEs — the architectural requirement to export components collides with documentation that normalized this exposure as standard practice. For defenders: verify whether your autofill service has any exported components beyond the explicit AutofillService interface. Android's Lint tooling flags improper exports, but enforcement varies. Prioritize auditing any credential-handling app that exposes exported activities or services, regardless of permission flags on the autofill permission itself. The platform-level risk is that autofill services represent a single point of compromise with outsized blast radius, and the CVSS framework doesn't capture this asymmetry.

Reviewed through automated stages and approved by a human before publication.