CVE-2026-20990: 
NixOS vulnerability analysis and mitigation

CVE-2026-20990 is an improper export of Android application components vulnerability in Samsung's Secure Folder feature, classified under CWE-926. It allows local attackers with low privileges to launch arbitrary activities with Secure Folder privileges. The vulnerability affects Samsung Android versions 14, 15, and 16 prior to the SMR Mar-2026 Release 1 security update. It was published on March 16, 2026, and carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 8.4 (High) (Samsung Security).

The root cause is improper export of Android application components (CWE-926) within the Secure Folder application, meaning certain Android components (such as Activities, Services, or Broadcast Receivers) are exported without adequate access controls. A local attacker with low-privilege access can craft an Intent targeting these improperly exported components to launch arbitrary activities under the elevated Secure Folder privilege context. Exploitation requires local device access and low-level privileges, but no user interaction is needed (Samsung Security).

Successful exploitation allows a low-privilege local attacker to execute arbitrary activities with Secure Folder's elevated privileges, potentially gaining unauthorized access to data and functionality protected within Secure Folder. This could result in unauthorized reading and modification of sensitive data stored in the Secure Folder environment, including files, contacts, and application data isolated within it. The integrity and confidentiality of protected content are at risk, though availability impact is assessed as low (Samsung Security).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of disclosure (Samsung Security). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013%, indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported.

1. Reconnaissance: Identify a Samsung Android device (versions 14, 15, or 16) running a Secure Folder version prior to SMR Mar-2026 Release 1 with local access to the device (physical or via a malicious app with low privileges).
2. Enumerate exported components: Use Android tooling such as adb shell dumpsys package <secure_folder_package> or static analysis tools (e.g., APKTool, jadx) to identify improperly exported Activity components within the Secure Folder application.
3. Craft malicious Intent: Construct an explicit Android Intent targeting the identified exported Activity component of the Secure Folder package, potentially with crafted extras or data URIs to trigger specific functionality.
4. Launch arbitrary activity: Execute the Intent via adb shell am start or from a malicious application installed on the device, causing the targeted Activity to launch with Secure Folder's elevated privileges.
5. Access protected data/functionality: Leverage the elevated Secure Folder privilege context to read, modify, or exfiltrate sensitive data stored within Secure Folder, or to perform unauthorized actions within the protected environment (Samsung Security).

• Logs: Android system logs (logcat) showing unexpected Intent launches targeting Secure Folder package components from low-privilege or third-party applications; entries such as ActivityManager: START ... cmp=<secure_folder_package>/<exported_activity> initiated by an unexpected calling package.
• Process/Application Behavior: Unusual activity launches within the Secure Folder context not initiated by the user; third-party applications making explicit Intent calls to Secure Folder components.
• File System: Unexpected access or modification timestamps on files stored within the Secure Folder data directory (/data/user/<user_id>/<secure_folder_package>/).

Samsung has released a patch in SMR Mar-2026 Release 1 for Samsung Android versions 14, 15, and 16. Users and administrators should update affected Samsung devices to the March 2026 security patch level or later as the primary remediation (Samsung Security). As a supplementary measure, restricting physical and application-level local access to sensitive devices can reduce the attack surface until patching is complete. No configuration-based workaround has been published by Samsung.

The vulnerability received routine coverage from Samsung-focused community sites and CVE tracking services shortly after disclosure, including mentions on SammyFans and automated CVE feed aggregators (SammyFans). No notable independent researcher commentary or significant media coverage beyond standard vulnerability tracking has been identified. Social media activity was limited to automated CVE notification accounts.