This vulnerability (CVE-2026-21006) affects Samsung DeX on Samsung Mobile Devices before the SMR Apr-2026 Release 1. It is classified as CWE-284 (Improper Access Control) and allows physical attackers to bypass access controls to view hidden notification contents. The CVSS 4.0 base score is 4.7 (medium), reflecting that the attack vector requires physical access but no privileges or user interaction. The vulnerability impacts confidentiality by exposing notification data. No vendor advisory or patch information is currently available to confirm remediation status.

An attacker with physical access to a vulnerable Samsung Mobile Device running Samsung DeX prior to the specified release can access hidden notification contents that should otherwise be protected. This exposure could lead to leakage of potentially sensitive information contained in notifications. There is no indication of remote exploitation or privilege escalation. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or update is released by Samsung, physical access to devices should be restricted to trusted individuals to mitigate risk. Monitor Samsung Mobile security advisories for updates regarding this vulnerability.