Executive brief
A vulnerability in Samsung's Routines feature on Android 16 devices could allow an individual with physical access to the device to perform unauthorized actions. By bypassing input validation, an attacker could launch privileged activities that are normally restricted. This could lead to unauthorized access to device functions or data if the device is physically compromised.
Technical details
An improper input validation vulnerability exists in the Samsung Routines component on devices running Android 16. The flaw allows a physical attacker with direct access to the device to bypass security checks and launch privileged activities. The root cause is insufficient validation of input within the Routines logic. Samsung has addressed this in the SMR May-2026 Release 1 by adding proper check logic to the affected component. The vulnerability is tracked by Samsung as SVE-2025-2186.
Affected products
- Samsung Android 16 Prior to SMR May-2026 Release 1
Timeline
- 2026-05-13: advisory: Samsung and NVD published the advisory.
- 2026-05-13: patched: Fix released in SMR May-2026 Release 1.