Security researchers have demonstrated a sophisticated multi-step exploit chain that turns Samsung’s native software and virtual assistant against user devices, achieving full remote system-level compromise. According to SecurityWeek, the research was conducted by Dimitrios Valsamaras, a senior security researcher at Microsoft, and Ken Gannon, head of mobile research at Mobile Hacking Lab. The team successfully demonstrated this attack at the Pwn2Owen Ireland hacking competition, earning a $50,000 bounty by targeting a Samsung Galaxy S25 device.
Technical Analysis of the Samsung Exploit Chain
The attack begins when an unsuspecting user clicks a malicious link delivered through targeted advertising or a messaging application. This initial user interaction triggers the first component of the attack, leveraging CVE-2025-21079 to force the preinstalled Samsung Members support application to connect to an external malicious website.
Once connected, the malicious site forces Samsung Members to launch the Samsung Account application. At this stage, the attack utilizes a second flaw, tracked as CVE-2025-58486, to redirect Samsung Account toward another attacker-controlled endpoint. This endpoint exploits a cross-site scripting vulnerability identified as CVE-2025-58487, which forces Samsung Account to open Bixby, the built-in virtual assistant.
Weaponizing Bixby Capsules and Background Services
The pivot into Bixby succeeds because the Samsung Account application holds specific elevated permissions required to interact with internal entry points within the virtual assistant. Gannon described this mechanism to SecurityWeek as a trusted ‘side entrance’ for which Samsung Account acts as a key holder.
After reaching Bixby, the attackers targeted ‘Capsules,’ which are hidden background micro-services designed to handle specific app tasks initiated by voice commands or device automation routines. Because normal Android isolation restricts direct communication with these sensitive background handlers, the researchers reverse-engineered the underlying infrastructure. By forcing Bixby to interact with these Capsules maliciously, the attackers successfully exfiltrated sensitive user data and gained system-level permissions on the device.
Impact and Vulnerability Scope
System-level permissions represent the highest privilege tier accessible on a stock consumer Android build. Once achieved, attackers can execute arbitrary code and establish persistent control over the targeted mobile hardware. The researchers confirmed successful reproduction of the exploit chain across several flagship device models, including the Samsung Galaxy S25, Galaxy S24, and Galaxy Flip 7.
Older device models that rely on the same preinstalled application ecosystem may also be vulnerable, provided the requisite applications are active on the operating system.
Remediation and Mitigations
Samsung responded to the findings by releasing a series of security updates. Patches addressing the Samsung Members application flaws were rolled out in November 2025 to break the initial browser-based trigger vector. Subsequent patches deployed in December 2025 resolved the vulnerabilities affecting the Samsung Account application.
Defenders and device administrators managing mobile fleets should ensure the following actions are prioritized:
- Apply all vendor-supplied software updates released from November 2025 onward immediately.
- Verify that core system and support applications, including Samsung Members and Samsung Account, are running the latest patched versions.
- Educate users on the risks of interacting with unsolicited links delivered via messaging apps or advertisements, which serve as the primary delivery vector for this attack chain.
Related: CVE-2024-10022: Progress ShareFile Storage Zones Controller Zero-Day, SonicWall SMA1000 Series RCE via CVE-2026-15409 — Mitigation Guide