Improper access control within Samsung DeX allows a physically present attacker to view the contents of hidden notifications that should normally remain private. The flaw does not enable code execution or privileged escalation, but it does expose potentially sensitive information such as personal messages, application data, or authentication details that are normally concealed from other apps. This leads to an information‑disclosure risk for the confidentiality of the device’s user data, corresponding to an access control weakness.

All Samsung Mobile Devices running Android 15.0 that have not yet received the Samsung Mobile Release (SMR) April 2026 Release 1 upgrade. The affected builds include the numerous SMR 2025‑2026 releases recorded in the provided CPE entries.

The CVSS score of 4.7 indicates moderate severity, reflecting that the flaw requires physical possession of the device and the ability to launch Samsung DeX. The EPSS score of less than 1 % suggests that exploitation attempts are unlikely. The vulnerability is not listed in the CISA KEV catalog, indicating no known public exploits. Attackers would need to be physically present and able to activate Samsung DeX in order to read hidden notification contents; no remote trigger or software exploit is indicated by the current data.