CVE-2026-21131: Samsung Mobile Samsung Flow

Low severity, CVSS 2.1. EPSS: 0.1% chance of exploitation in the next 30 days.

Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.

Affected products

• Samsung Mobile Samsung Flow: before 4.9.22.4 (fixed in 4.9.22.4)

Published 2026-10-12. Last modified 2026-10-15.