CVE-2026-21118

Executive Summary

CVE-2026-21118 is an improper access control vulnerability in the DownloadProvider component affecting Android devices, patched in Samsung's SMR Oct-2026 Release 1. Local attackers can exploit this flaw to access files within scoped storage, potentially leading to unauthorized information disclosure. With no CVSS score, EPSS score, or public proof-of-concept currently available, the immediate risk is primarily to unpatched devices where a malicious local app could bypass storage isolation.

Technical Analysis

The vulnerability resides in DownloadProvider, an Android system component responsible for managing downloads and file access. The core issue is improper access control (CWE-284), meaning the component fails to adequately enforce access restrictions, allowing a local attacker—typically a malicious application installed on the device—to read files in scoped storage. Scoped storage is Android's security model that isolates app-specific files from other apps. By bypassing this isolation, an attacker can access sensitive files belonging to other applications, such as databases, configuration files, or user data. The exact code-level flaw is not described in the available NVD entry, so the specific missing permission check or path traversal mechanism cannot be confirmed from this data alone. The attack vector is local (AV:L), requiring the attacker to have the ability to execute code on the device, such as through a downloaded app. No user interaction (UI:N) or privileges (PR:N) are needed beyond app installation, indicating a relatively low barrier to exploitation. The patch is delivered via Samsung's SMR Oct-2026 Release 1, indicating a vendor-specific fix rather than an open-source Android bulletin patch.

Exploitation Scenarios

1. Reconnaissance/target identification: The attacker identifies a target device running an unpatched Android version (pre-SMR Oct-2026 Release 1). This could be done via social engineering or by distributing a malicious app through third-party app stores.
2. Triggering the flaw: The attacker crafts a malicious application that interacts with the DownloadProvider component. Because of improper access control, the app can request or access files outside its designated scoped storage sandbox. The exact API or intent used is not specified in the available description; the attack relies on the vulnerability class—access control bypass—rather than a specific known exploit.
3. Payload/execution method: The malicious app executes code that queries DownloadProvider for file listings or directly reads file contents. No public PoC exists; the attack chain is inferred from the vulnerability class. The attacker would likely enumerate accessible paths or use content resolvers to access protected directories.
4. Post-exploitation impact: The attacker gains unauthorized read access to files in scoped storage, which may include credentials, tokens, personal data, or application-specific secrets. This information can be exfiltrated to a remote server, leading to privacy breaches or further compromise of other accounts and services.

Impact Assessment

The vulnerability allows local information disclosure, with a high confidentiality impact (C:H) based on the inferred CVSS vector. Integrity and availability impacts are none (I:N/A:N). The attack requires local access (AV:L) and no privileges (PR:N) or user interaction (UI:N), making it exploitable by any installed app. The blast radius includes any Android device that has not received the SMR Oct-2026 Release 1, particularly those running older Android versions or with delayed security updates. Business impact includes potential data leakage of sensitive corporate or personal data stored in scoped storage, regulatory compliance issues, and reputational damage. No CVSS score is officially assigned, so the vector provided is an estimate based on the description.

Detection Guidance

Sigma Rule

title: Potential DownloadProvider Access Control Bypass
id: 8f4a2b1c-3d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to access files outside scoped storage via DownloadProvider
author: Threat Intelligence Team
date: 2026-02-14
logsource:
  product: android
  service: audit
detection:
  selection:
    EventID: 1001  # Example: Android audit event for file access
    Component: DownloadProvider
    Action: file_access
    Path|contains: '/data/data/'
  condition: selection
falsepositives:
  - Legitimate file access by system apps
level: medium

YARA Rule

rule CVE_2026_21118_DownloadProvider_Access
{
    meta:
        description = "Detects malicious apps exploiting DownloadProvider access control bypass"
        author = "Threat Intelligence Team"
        date = "2026-02-14"
        reference = "CVE-2026-21118"
    strings:
        $pkg = "com.android.providers.downloads"
        $api = "content://downloads/"
        $scoped = "/storage/emulated/0/Android/data/"
    condition:
        $pkg and $api and #scoped > 0
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-21118 DownloadProvider Scoped Storage Access Attempt"; flow:to_server,established; content:"/downloads/"; http_uri; content:"../"; http_uri; reference:cve,2026-21118; classtype:attempted-user; sid:1000001; rev:1;)

Elastic Detection

process where event.type == "start" and process.name == "com.android.providers.downloads" and file.path : ("/data/data/*", "/storage/emulated/0/Android/data/*")

Splunk SPL Query

index=android_logs sourcetype=android:audit Component=DownloadProvider Action=file_access | search Path=*/data/data/* OR Path=*/Android/data/* | stats count by src_ip, user, Path

Wazuh OSSEC Rule

<rule id="100100" level="10">
  <decoded_as>json</decoded_as>
  <field name="Component">DownloadProvider</field>
  <field name="Action">file_access</field>
  <field name="Path">/data/data/</field>
  <description>CVE-2026-21118: Possible DownloadProvider scoped storage access bypass</description>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Restrict installation of apps from untrusted sources; enforce mobile device management (MDM) policies to block sideloading; monitor for suspicious file access patterns via EDR/mobile threat defense.
2. Patch/upgrade steps: Apply Samsung SMR Oct-2026 Release 1 as soon as it becomes available for affected devices. For non-Samsung Android devices, monitor Google's Android Security Bulletin for a corresponding patch. Since no patch evidence exists, verify vendor advisories regularly.
3. Long-term hardening: Implement regular security update cycles; use app sandboxing and permission controls; conduct threat modeling for system components like DownloadProvider; enable auditing of scoped storage access.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-21118
• Samsung Mobile Security Updates: https://security.samsungmobile.com/securityUpdate.smsb
• Android Scoped Storage Documentation: https://developer.android.com/training/data-storage
• CWE-284: Improper Access Control: https://cwe.mitre.org/data/definitions/284.html
• No known threat actor campaigns or exploit-in-the-wild evidence available at this time.