This vulnerability (CVE-2026-21060) affects Samsung Contacts on Samsung Mobile Devices before the SMR Aug-2026 Release 1. It is caused by improper input validation (CWE-20), which enables physical attackers to bypass user profile data isolation and access data across multiple profiles. The CVSS 4.0 score is 6.7, reflecting medium severity with physical attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and security controls. There is no vendor advisory or patch information available at this time.

An attacker with physical access to the device can exploit this vulnerability to access data belonging to multiple user profiles, potentially compromising sensitive information. The vulnerability impacts confidentiality and security controls but does not affect integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict physical access to affected devices to mitigate risk.