Loading story…
Researchers disclosed a Samsung smartphone exploit chain that turned a malicious link into remote system-level compromise by chaining flaws in Samsung Members, Samsung Account, and Bixby. Demonstrated at Pwn2Own Ireland 2025 against a Galaxy S25 and later detailed at Black Hat 2026, the attack used CVE-2025-21079, CVE-2025-58486, and CVE-2025-58487 to pivot across Samsung apps and abuse Bixby’s Capsule infrastructure, enabling sensitive data theft, elevated privileges, and ultimately remote code execution on stock devices.
Samsung’s mobile security advisories show the affected ecosystem also included multiple high-severity weaknesses across Samsung software, including Samsung Members, Bixby wakeup, Samsung Gallery, Secure Folder, and libsavscmn, with impacts ranging from arbitrary file read/write and lock reset to memory corruption and code execution. Samsung said it patched the Samsung Members issue in November 2025 and the Samsung Account flaws in December 2025; the exploit chain was reproduced on Galaxy S25, S24, and Flip 7 devices, and researchers warned that older phones may remain vulnerable if they did not receive the updates.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
The researchers later presented technical details of the Samsung smartphone exploit chain at Black Hat 2026. They described how a malicious link could abuse Samsung Members, Samsung Account, and Bixby Capsule infrastructure to exfiltrate data, gain system privileges, and achieve remote code execution.
Samsung released patches in December 2025 for the Samsung Account vulnerabilities used in the exploit chain. These fixes addressed the issues that let attackers pivot from Samsung Members into Samsung Account and then into Bixby.
Samsung released patches for the Samsung Members issue in November 2025. According to the researchers, these updates blocked triggering the exploit chain through a web browser or messaging app.
In October 2025, Dimitrios Valsamaras of Microsoft and Ken Gannon of Mobile Hacking Lab demonstrated an exploit chain against a Samsung Galaxy S25 at Pwn2Own Ireland. They earned $50,000 for chaining flaws in Samsung Members, Samsung Account, and Bixby to achieve remote system-level compromise.
Samsung's bulletin says the disclosed application vulnerabilities were reported over a period spanning April 2024 through April 2025. The affected components included Samsung Members, Bixby wakeup, Samsung Gallery, Bixby Vision, Samsung Flow, Secure Folder, PackageInstallerCN, AODService, Samsung Notes, PENUP, and libsavscmn.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcesecurityweek.com
Open sourcesecurity.samsungmobile.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Samsung disclosed two **Galaxy S25** vulnerabilities reported through **Pwn2Own** that could be triggered remotely with user interaction. One flaw, **CVE-2025-58486** (`ZDI-26-224` / `ZDI-CAN-28456`), affects the **Samsung Account** application and allows arbitrary script execution in the current `WebView` through a cross-site scripting issue caused by improper validation of user-supplied data. The bug was assigned a **CVSS 6.3** score and was credited to Ken Gannon, 伊藤 剣 (@yogehi) of Mobile Hacking Lab, and Dimitrios Valsamaras (@Ch0pin). A second issue, **CVE-2025-58488** (`ZDI-26-223` / `ZDI-CAN-28331`), affects the **Smart Touch Call** application and can disclose sensitive information, including stored credentials, because of insufficient protection around URL-parameter-driven functionality. That flaw received a **CVSS 5.9** score and was credited to **Interrupt Labs**. In both cases, exploitation requires a victim to visit a malicious page or open a malicious file, and **Samsung has released updates** to remediate the vulnerabilities.
Jun 29, 2026
Samsung disclosed multiple vulnerabilities affecting Galaxy devices, including **remote code execution** flaws in the proprietary Quram image codec and a separate **improper access control** bug in the Routines automation feature. **CVE-2025-21042** and **CVE-2025-21043** are out-of-bounds write issues in `libimagecodec.quram.so` that can be triggered by specially crafted images delivered through MMS, email attachments, messaging apps, or web content, potentially with little or no user interaction. Samsung said **CVE-2025-21042** was fixed in the **April 2025 Security Maintenance Release**, while **CVE-2025-21043** was addressed in the **September 2025 SMR**. The disclosures revive longstanding concerns around Samsung’s proprietary image parsing stack, which Google Project Zero previously showed could be exploited through malformed Qmage images in a **zero-click MMS** chain that achieved code execution on a Galaxy Note 10+. Samsung also patched **CVE-2025-21058**, which allowed a local attacker on Android 15 and 16 devices to execute arbitrary code with **SystemUI privileges** via Galaxy Routines before versions **4.8.7.1** and **4.9.6.0**. Separately, Google fixed Android framework flaw **CVE-2025-32322** in the September 2025 Android Security Bulletin after it was found to let a malicious app bypass the MediaProjection consent dialog and silently capture screen content on Android 13 and 14.
Jun 29, 2026
Researchers at LucidBit Labs disclosed **CVE-2026-20971**, a high-severity use-after-free flaw in Samsung’s **KNOX** framework that left millions of Galaxy devices exposed to potential kernel-level attacks for roughly eight years. The bug affected Galaxy **S9 through S25** models, tested **A-series** devices including the **A54**, and both **Exynos** and **Qualcomm** variants across Android **13, 14, 15, and 16**. Samsung said the issue was fixed in its **January 2026** Android security update, and users were urged to verify a security patch level of **`2026-01-01`** or later. The vulnerability was traced to a race condition between KNOX’s **PROCA** process authenticator and the **FIVE** kernel integrity subsystem, specifically involving `procfs` handlers under `/proc/pid/integrity/` that accessed a `task_integrity` object without a proper reference in a fully preemptive kernel. LucidBit said the flaw could let a local untrusted app trigger kernel memory corruption and identified exploitation primitives including a memory leak that could aid **KASLR** bypass, an arbitrary-call path mitigated by **KCFI**, and a constrained write through spinlock operations on reclaimed memory. Although exploitation required local access and user interaction, researchers warned that a compromised Galaxy device could still enable deeper device takeover and provide a foothold for attacks against enterprise environments.
Jun 29, 2026