CVE-2026-21060 is an input validation vulnerability in Samsung Contacts versions prior to SMR Aug-2026 Release 1. It permits physical attackers to bypass user profile data isolation, potentially accessing data across multiple profiles on the device. The vulnerability has a CVSS 4.0 vector indicating physical attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and security controls. No vendor advisory or patch details are available at this time.

The vulnerability allows unauthorized physical attackers to access data belonging to multiple user profiles on the affected Samsung Contacts application. This compromises data confidentiality across user boundaries on the device. There is no indication of remote exploitation or privilege escalation beyond physical access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict physical access to affected devices to mitigate risk.