Loading story…
A researcher disclosed an exploit chain targeting the Samsung Galaxy Store on the Samsung S22 that used a single malicious click to trigger app installation and launch. The attack abused Galaxy Store deeplink handling and a server-side open redirect on us.mcsvc.samsung.com, allowing a trusted internal WebView to be redirected to an apps.samsung.com deeplink with parameters such as directInstall=true and directOpen=true. That flow caused the Galaxy Store to automatically install and immediately open a Samsung application without additional user interaction.
The technique built on earlier 2021 research into Galaxy Store internals, where an XSS flaw in redirect.html and access to the Galaxy Store JavaScript interface had enabled code execution in an internal WebView. After Samsung fixed the XSS issue, the researcher found that a new open-redirect condition remained exploitable and reported that Samsung issued multiple server-side patches before fully resolving the problem on December 2, 2022, with bypasses identified during the remediation process. Users were advised to update the Galaxy Store application to the latest available version.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
STAR Labs publicly disclosed the exploitation details, contrasted the 2021 and 2022 chains, and advised users to update the Galaxy Store application to the latest version.
According to the write-up, Samsung finally resolved the server-side open-redirect vulnerability after several patch attempts.
Samsung repeatedly patched and re-patched the server-side open-redirect issue, but the researcher found bypasses during the remediation period.
The Samsung Galaxy Store one-click/open-redirect exploit chain was developed and presented in connection with Pwn2Own Toronto 2022, demonstrating compromise of a Samsung S22 device.
After the XSS fix, the researcher identified a new server-side open redirect on us.mcsvc.samsung.com and chained it with Galaxy Store deeplink handling to trigger automatic app installation and launch on a Samsung S22 with one click.
Samsung patched the earlier XSS vulnerability in redirect.html, closing the original 2021 exploit path described by the researcher.
Prior Galaxy Store research in 2021 found that a deeplink into Samsung's McsWebViewActivity combined with an XSS flaw in redirect.html could execute JavaScript in an internal WebView and access the GalaxyStore JavaScript interface.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
starlabs.sg
Open sourcestarlabs.sg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Samsung disclosed two **Galaxy S25** vulnerabilities reported through **Pwn2Own** that could be triggered remotely with user interaction. One flaw, **CVE-2025-58486** (`ZDI-26-224` / `ZDI-CAN-28456`), affects the **Samsung Account** application and allows arbitrary script execution in the current `WebView` through a cross-site scripting issue caused by improper validation of user-supplied data. The bug was assigned a **CVSS 6.3** score and was credited to Ken Gannon, 伊藤 剣 (@yogehi) of Mobile Hacking Lab, and Dimitrios Valsamaras (@Ch0pin). A second issue, **CVE-2025-58488** (`ZDI-26-223` / `ZDI-CAN-28331`), affects the **Smart Touch Call** application and can disclose sensitive information, including stored credentials, because of insufficient protection around URL-parameter-driven functionality. That flaw received a **CVSS 5.9** score and was credited to **Interrupt Labs**. In both cases, exploitation requires a victim to visit a malicious page or open a malicious file, and **Samsung has released updates** to remediate the vulnerabilities.
Jun 29, 2026
Researchers disclosed a Samsung smartphone exploit chain that turned a malicious link into **remote system-level compromise** by chaining flaws in **Samsung Members**, **Samsung Account**, and **Bixby**. Demonstrated at Pwn2Own Ireland 2025 against a **Galaxy S25** and later detailed at Black Hat 2026, the attack used `CVE-2025-21079`, `CVE-2025-58486`, and `CVE-2025-58487` to pivot across Samsung apps and abuse Bixby’s Capsule infrastructure, enabling sensitive data theft, elevated privileges, and ultimately remote code execution on stock devices. Samsung’s mobile security advisories show the affected ecosystem also included multiple high-severity weaknesses across Samsung software, including **Samsung Members**, **Bixby wakeup**, **Samsung Gallery**, **Secure Folder**, and `libsavscmn`, with impacts ranging from arbitrary file read/write and lock reset to memory corruption and code execution. Samsung said it patched the Samsung Members issue in **November 2025** and the Samsung Account flaws in **December 2025**; the exploit chain was reproduced on **Galaxy S25, S24, and Flip 7** devices, and researchers warned that older phones may remain vulnerable if they did not receive the updates.
Aug 8, 2026
Samsung disclosed multiple vulnerabilities affecting Galaxy devices, including **remote code execution** flaws in the proprietary Quram image codec and a separate **improper access control** bug in the Routines automation feature. **CVE-2025-21042** and **CVE-2025-21043** are out-of-bounds write issues in `libimagecodec.quram.so` that can be triggered by specially crafted images delivered through MMS, email attachments, messaging apps, or web content, potentially with little or no user interaction. Samsung said **CVE-2025-21042** was fixed in the **April 2025 Security Maintenance Release**, while **CVE-2025-21043** was addressed in the **September 2025 SMR**. The disclosures revive longstanding concerns around Samsung’s proprietary image parsing stack, which Google Project Zero previously showed could be exploited through malformed Qmage images in a **zero-click MMS** chain that achieved code execution on a Galaxy Note 10+. Samsung also patched **CVE-2025-21058**, which allowed a local attacker on Android 15 and 16 devices to execute arbitrary code with **SystemUI privileges** via Galaxy Routines before versions **4.8.7.1** and **4.9.6.0**. Separately, Google fixed Android framework flaw **CVE-2025-32322** in the September 2025 Android Security Bulletin after it was found to let a malicious app bypass the MediaProjection consent dialog and silently capture screen content on Android 13 and 14.
Jun 29, 2026