BLACK HAT – Two security researchers found a way to exploit vulnerabilities in Samsung software, including the virtual assistant Bixby, to hack mobile devices.
The research was conducted by Dimitrios Valsamaras, senior security researcher at Microsoft, and Ken Gannon, head of mobile research at Mobile Hacking Lab.
Gannon and Valsamaras demonstrated the vulnerabilities at the Pwn2Own Ireland hacking competition in October 2025, where they earned $50,000 after exploiting them to hack a Samsung Galaxy S25 device.
The researchers have now detailed their findings in a talk at the Black Hat conference, describing the vulnerabilities they discovered and how they were chained to achieve remote system-level compromise.
The exploit developed by Gannon and Valsamaras starts with an attacker tricking the targeted user into clicking a link delivered via malicious ads or a messaging application.
After the victim clicks on the link, a vulnerability tracked as CVE-2025-21079 is exploited to force Samsung Members to connect to a malicious website. Samsung Members is an official user community, diagnostics, and support app that is preloaded on many mid-range and flagship Galaxy smartphones.
The malicious site then forces Samsung Members to open the Samsung Account app, which is designed to connect users to Samsung services.
Next, a different vulnerability, CVE-2025-58486, is used to force Samsung Account to connect to an attacker-controlled website. This site then exploits an XSS vulnerability tracked as CVE-2025-58487 to force Samsung Account to open Bixby, the virtual assistant that can handle voice commands, visual searches, and device automation routines.
The researchers told SecurityWeek that this is possible because the Samsung Account app has a special permission that is required to interact with a specific ‘entry point’ in Bixby.
“Think of it as a ‘side entrance’ and Samsung Account happens to be a key holder for the ‘side entrance,’” explained Gannon.
The next stage of the attack involves a Capsule, a hidden background service inside an app that acts like a mini internal server. When users issue a voice command, Bixby translates the request and sends it to the app’s Capsule to perform the actual task. Because Capsules can directly control app functions, Samsung restricts access so that normally only Bixby is allowed to talk to them.
However, the researchers reverse-engineered the Capsule infrastructure on Samsung phones and found a way to force Bixby to use various Capsules maliciously.
This enabled an attacker to exfiltrate sensitive data and achieve system-level permissions on the Android device—the highest privilege level that can be achieved on a stock consumer device.
The researchers showed that once an attacker has obtained ‘system’ permissions, they can achieve remote code execution and take control of the device.
The researchers said they successfully reproduced the exploit on Samsung Galaxy S25, S24, and Flip 7 smartphones.
Vulnerabilities patched by Samsung
Samsung started patching the vulnerabilities a few weeks after the Pwn2Own competition. Specifically, the company rolled out patches for the Samsung Members application in November 2025, preventing the exploit chain from being triggered via a web browser or messaging app. Patches released in December fixed the Samsung Account flaws.
The researchers told SecurityWeek that the attack works on older Samsung devices, which may not have received the patches, but noted that the exploit requires all of the targeted apps to be installed. While flagship models come with the apps preinstalled, it’s unclear if that applies to budget models as well.
Samsung has not responded to SecurityWeek’s request for comment.
Related: Eight-Year-Old Samsung KNOX Flaw Exposed Millions of Galaxy Devices to Kernel Attacks
Related: What’s Hiding in Your Mobile Apps? Lookout MSEC Aims to Find Out
Related: New Exploit Bypasses Apple’s Boot Defenses, Affects Millions of iPhones
