Samsung Members - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/samsung-members/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 05 Aug 2026 20:28:04 +0000Exploit Chain Leading to System-Level Compromise on Samsung Mobile Deviceshttps://feed.craftedsignal.io/briefs/2026-08-samsung-bixby-exploit/Wed, 05 Aug 2026 20:28:04 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-samsung-bixby-exploit/Researchers demonstrated a $50,000 exploit chain utilizing three vulnerabilities in Samsung Members, Samsung Account, and Bixby to achieve remote system-level code execution on flagship Galaxy devices.In October 2025, security researchers Dimitrios Valsamaras (Microsoft) and Ken Gannon (Mobile Hacking Lab) demonstrated a multi-stage exploit chain at the Pwn2Own Ireland competition. The research, later detailed at Black Hat 2026, describes how an attacker can chain vulnerabilities across preinstalled Samsung applications to gain system-level access on devices including the Samsung Galaxy S25, S24, and Flip 7. The chain requires victim interaction with a malicious link, which triggers a sequence of forced redirects through the Samsung Members and Samsung Account applications. By exploiting an XSS vulnerability, the attackers gained unauthorized access to the Bixby 'Capsule' infrastructure - a hidden background service used for voice command processing. Accessing these Capsules allowed for data exfiltration and the attainment of system-level privileges, enabling remote code execution on the targeted Android smartphones. Samsung issued patches for Samsung Members in November 2025 and for Samsung Account in December 2025.

Attack Chain

  1. The attacker lures the victim into clicking a malicious link via web advertising or a messaging application.
  2. CVE-2025-21079 is triggered upon link interaction, forcing the Samsung Members application to navigate to an attacker-controlled website.
  3. The malicious website forces the Samsung Members application to trigger the Samsung Account application.
  4. CVE-2025-58486 is exploited within the Samsung Account application to force it to connect to an attacker-controlled malicious domain.
  5. The attacker exploits an XSS vulnerability (CVE-2025-58487) within the Samsung Account application context.
  6. The XSS execution is used to interact with a specific, restricted Bixby entry point for which Samsung Account holds special permissions.
  7. The attacker interacts with the Bixby Capsule infrastructure to bypass internal command restrictions.
  8. The attacker achieves system-level permissions on the Android device, facilitating full device control and data exfiltration.

Impact

The exploit chain allows for remote system-level compromise, the highest privilege level on consumer Android devices. Successful exploitation enables attackers to achieve remote code execution, exfiltrate sensitive user data, and gain persistent control over the device. While demonstrated on flagship Galaxy S25, S24, and Flip 7 models, the researchers noted the vulnerability affects older Samsung devices that may lack the patches released by the manufacturer in late 2025.

Recommendation

  • Ensure all Samsung mobile devices are updated to the latest security firmware provided by the manufacturer to include the patches for CVE-2025-21079, CVE-2025-58486, and CVE-2025-58487.
  • Implement mobile device management (MDM) policies to enforce OS and application updates across the enterprise mobile fleet.
  • Educate users regarding the risks associated with clicking suspicious links received through unverified messaging channels or advertisements on mobile devices.
  • Audit and restrict permissions granted to preinstalled system applications if the mobile management platform supports granular configuration.
]]>highadvisory