Loading vulnerability…
Improper access control in Samsung Routines leading to SystemUI privilege code execution
CVE-2025-21058 is an improper access control vulnerability in Samsung's Routines automation component on Galaxy devices. It affects Routines versions prior to 4.8.7.1 on Android 15 and prior to 4.9.6.0 on Android 16. According to the provided content, the flaw is caused by insufficient authorization checks in Routines, which exposed privileged operations to local processes without properly validating caller identity or permissions. A local attacker on the device could abuse this weakness to execute arbitrary code in a SystemUI-privileged context, crossing the intended boundary between ordinary applications and system-level components.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in arbitrary code execution with SystemUI privileges. This gives an attacker significantly elevated capabilities relative to a normal application, including broad control over system UI elements and access to sensitive resources available to the SystemUI context. The vulnerability therefore represents a local privilege escalation path from a less-privileged local process or attacker-controlled local context into a privileged system component.
If you can’t patch tonight, do this now.
Apply Samsung security updates that include the patched Routines component. Until patching is completed, reduce exposure by limiting local attacker access to the device, restricting installation or execution of untrusted applications, and enforcing enterprise/mobile-device-management controls where available. No specific vendor-supplied workaround beyond updating is provided in the supplied content.
Patch, then assume compromise.
Update Samsung Routines to the fixed versions identified by Samsung: version 4.8.7.1 or later on Android 15, and version 4.9.6.0 or later on Android 16. Samsung's fix reportedly adds proper access control and authorization checks to prevent untrusted local callers from invoking privileged operations.
No public exploits tracked yet. Mallory keeps watching.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.