A $50,000 Exploit Chain Turns Bixby Against Samsung Phones, Exposing Users to Remote System-Level Compromise
Two security researchers have demonstrated a sophisticated exploit chain that can hack into Samsung mobile devices by manipulating the virtual assistant Bixby. Dimitrios Valsamaras and Ken Gannon, who presented their findings at the Black Hat conference, showed how an attacker can use vulnerabilities in Samsung software to remotely compromise system-level permissions on Android devices.
The researchers successfully exploited the vulnerabilities on Samsung Galaxy S25, S24, and Flip 7 smartphones, earning them a $50,000 prize at the Pwn2Own Ireland hacking competition last October. The exploit chain starts with an attacker tricking a user into clicking a malicious link delivered via advertisements or messaging applications. This initial click exploits a vulnerability tracked as CVE-2025-21079 in Samsung Members, an official app preloaded on many mid-range and flagship Galaxy smartphones.
Once the user clicks on the link, the malicious site forces Samsung Members to open the Samsung Account app, which is designed to connect users to various Samsung services. A different vulnerability, CVE-2025-58486, is then used to force Samsung Account to connect to an attacker-controlled website. This site exploits another XSS vulnerability, CVE-2025-58487, to force Samsung Account to open Bixby.
The researchers explained that this is possible because the Samsung Account app has a special permission required to interact with a specific ‘entry point’ in Bixby, which they likened to a ‘side entrance’. They reverse-engineered the Capsule infrastructure on Samsung phones and found a way to force Bixby to use various Capsules maliciously.
This enabled an attacker to exfiltrate sensitive data and achieve system-level permissions on the Android device, allowing them to perform remote code execution and take control of the device. The researchers noted that while Samsung has patched some of these vulnerabilities, older devices may still be vulnerable, particularly if they have not received the necessary updates or do not have all the targeted apps installed.
The exploit chain is a sobering reminder of the potential risks associated with smartphone technology and the need for manufacturers to prioritize security in their products. While Samsung’s patches are an important step forward, users should remain vigilant and take steps to protect themselves from these types of attacks. Users can reduce their risk by keeping their devices and apps up-to-date, being cautious when clicking on links or installing new apps, and considering additional security measures such as antivirus software.
Ultimately, the success of this exploit chain highlights the importance of ongoing research into smartphone security vulnerabilities and the need for manufacturers to work closely with researchers to identify and address these issues before they can be exploited by attackers.
Source: SecurityWeek — 2026-08-05