That locked folder on your Samsung phone — the one where you stash private photos, banking apps, and documents you don't want anyone else to see — can be broken into without your password, thanks to a newly disclosed security flaw.
Who Is Affected and How Bad Is This?
Samsung Secure Folder is installed on hundreds of millions of Galaxy devices worldwide. It's one of the most-used privacy features in the Android ecosystem, relied upon by everyday users hiding personal photos, professionals keeping work apps sandboxed, domestic abuse survivors protecting sensitive communications, and journalists shielding source data. Samsung ships Galaxy devices in over 200 countries, and Secure Folder is enabled by default on flagship and mid-range models alike — meaning the potential blast radius here is enormous.
The vulnerability, tracked as CVE-2026-20990, carries a CVSS score of 8.1 (HIGH). That's not a theoretical edge case — that's a score security teams treat as a five-alarm fire. While no active exploitation has been confirmed yet, the window between public disclosure and attackers building working exploits can be measured in days, not months.
What an Attacker Can Actually Do to You
Imagine you hand your phone to a coworker to show them a funny video. Or you leave it briefly unlocked at a café while you grab your order. Or, more realistically, you install a seemingly harmless flashlight app or game that runs quietly in the background. In any of these scenarios, a malicious actor — or a malicious app already on your device — could exploit this flaw to effectively pick the lock on your Secure Folder without knowing your PIN, pattern, or password.
Here's what that looks like in practice: Secure Folder is designed to be a completely separate, isolated environment on your phone. Apps inside it, photos inside it, and data inside it are supposed to be walled off from everything else. This bug punches a hole in that wall. An attacker with access to your unlocked phone, or a rogue app running on it, can fire up any app living inside your Secure Folder — your private banking app, your hidden photo gallery, your second Instagram account — and interact with it as if they had your full credentials. They're not cracking a safe; they're walking through a door that was accidentally left unlatched.
The worst-case scenario isn't just someone seeing your private photos. It's a malicious app silently launching your banking app in the background, scraping session data, or manipulating what's displayed to you. It's an abusive partner installing a free wallpaper app to monitor what you've been hiding. The Secure Folder was built specifically to protect people in high-stakes personal situations. This flaw targets that protection directly.
The Technical Detail Security Researchers Need to Know
The vulnerability is classified as an improper export of Android application components — specifically, an Activity component within the Secure Folder application that was incorrectly marked as exported, making it accessible to any other application on the device without requiring elevated permissions. On Android, an exported Activity is one that can be started by external apps; when a privileged system application like Secure Folder accidentally exposes one, it creates a direct privilege escalation path. Any local app — even one with no special permissions — can craft an Intent to launch that Activity and inherit Secure Folder's elevated privilege context. The vulnerability class maps to CWE-926 (Improper Export of Android Application Components) and requires only local access, no network connection, and no user interaction beyond having a malicious app installed.
Discovery, Exploitation Status, and Known Campaigns
Samsung disclosed CVE-2026-20990 as part of its Samsung Monthly Security Release (SMR) for March 2026. The company has not publicly named the researcher or team who discovered and reported the flaw, which suggests it may have come through Samsung's internal security review or a private bug bounty submission rather than a dramatic public disclosure.
As of publication, no active exploitation has been confirmed in the wild, and no threat actor groups or malware campaigns have been publicly linked to this CVE. That is genuinely good news — but it's the kind of good news with an expiration date. Vulnerability classes like this one (exported Android components enabling privilege escalation) are well-understood by mobile malware authors and are frequently weaponized quickly after public disclosure. Security teams at enterprises managing Samsung device fleets should treat this as urgent. Individual users should update immediately and not wait for an automatic prompt.
The local attack vector does limit the threat compared to a remote exploit — an attacker can't hit you from across the internet with this bug alone. But "local" doesn't mean "safe." It means the attack happens on your device, via an app you've already installed, or someone who briefly has physical access. Both scenarios happen constantly in the real world.
What You Should Do Right Now
Here are three specific steps, in order of priority:
-
Update your Samsung device to SMR March 2026 Release 1 or later immediately.
Go to Settings → Software Update → Download and Install. The patch that closes this specific flaw is included in Samsung's March 2026 security release. Don't wait for the notification to pop up on its own — manually check now. If your device model is no longer receiving Samsung security updates, consider that a serious risk signal for Secure Folder use specifically. -
Audit what apps you have installed outside of Secure Folder.
Go to Settings → Apps and look for anything you don't recognize or haven't used in months. The attack vector here is a malicious local app. Delete anything suspicious. Be especially cautious of apps installed from outside the Google Play Store (sideloaded APKs), which have no malware screening. Until you've patched, minimize your installed app surface area. -
Temporarily move your most sensitive Secure Folder data to an alternative protected location if you cannot update immediately.
If your device is no longer receiving updates or you're waiting on a carrier-delayed rollout, consider temporarily moving critically sensitive files out of Secure Folder and into an encrypted third-party solution like Proton Drive or transferring them to a fully updated device. This is a stopgap — the real fix is the patch — but it reduces your exposure in the window before you can update.
CVE: CVE-2026-20990 | CVSS: 8.1 (HIGH) | Platform: Samsung Android | Patch: SMR Mar-2026 Release 1 | Exploitation: None confirmed as of publication