Samsung’s DownloadProvider implementation contains an improper access control flaw that permits a local attacker to read files stored in scoped storage. The vulnerability allows the attacker to bypass the intended file visibility constraints and potentially exfiltrate sensitive data without needing elevated privileges. The impact is primarily confidentiality loss for locally logged‑in users.

The flaw affects Samsung Mobile Devices running any software prior to the SMR Oct‑2026 Release 1 update. Specific models or OEM‑customized firmware that ship with an earlier version of DownloadProvider are therefore vulnerable.

The CVSS score of 6.9 reflects a medium‑high severity. Exploitation requires local physical access or administrator authority on the device, as the attacker must already be logged in to manipulate and trigger the provider. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely observed in the wild. Because the path requires local exploitation, the likelihood of attack is moderate in high‑risk environments such as shared or enterprise devices. Once local access is gained, the compromised DownloadProvider can be used to enumerate files and read arbitrary content in the scoped storage area, potentially revealing personal data or credential files.