Exploit Chain Leverages Samsung Apps to Hijack Bixby, Compromise Phones
Researchers demonstrated an exploit chain using Samsung Members and Samsung Account apps to gain system-level control of Galaxy devices via the Bixby virtual assistant.
Two security researchers have detailed a sophisticated exploit chain that targets pre-installed Samsung applications, including the Bixby virtual assistant, to achieve system-level compromise on Galaxy smartphones. The research, conducted by Dimitrios Valsamaras of Microsoft and Ken Gannon of Mobile Hacking Lab, was initially showcased at the Pwn2Own Ireland competition in October 2025, where it earned the researchers a $50,000 bounty for hacking a Samsung Galaxy S25.
The attack begins when a user clicks a malicious link, typically delivered via phishing emails or messaging apps. This action exploits a vulnerability, identified as CVE-2025-21079, which forces the Samsung Members app to connect to an attacker-controlled website. Samsung Members is a preloaded application on many Galaxy devices, serving as a portal for user communities, diagnostics, and support.
From the compromised Samsung Members app, the exploit chain then forces the Samsung Account app to open. This app, responsible for managing user access to Samsung services, is then manipulated via a second vulnerability, CVE-2025-58486. This flaw compels the Samsung Account app to connect to another malicious website, which in turn exploits a cross-site scripting (XSS) vulnerability, CVE-2025-58487.
The XSS vulnerability is the critical pivot point, enabling the attacker to force the Samsung Account app to open Bixby, Samsung's native virtual assistant. Researchers explained that the Samsung Account app possesses a special permission that allows it to interact with a specific 'entry point' within Bixby, akin to holding a key to a 'side entrance.' This interaction is normally restricted to legitimate Bixby functions.
Once Bixby is invoked maliciously, the exploit targets 'Capsules,' which are internal background services within apps that handle specific tasks for Bixby. By reverse-engineering the Capsule infrastructure, the researchers found a way to make Bixby interact with these Capsules in unintended ways. This allows for the exfiltration of sensitive data and the attainment of system-level permissions on the Android device, the highest privilege level available on consumer devices.
With system-level privileges, attackers can achieve remote code execution, effectively taking full control of the compromised device. The researchers successfully demonstrated this exploit chain on Samsung Galaxy S25, S24, and Flip 7 models. Samsung has since begun patching these vulnerabilities, releasing fixes for Samsung Members in November 2025 and for Samsung Account in December 2025.
While Samsung has addressed the flaws in newer software versions, the exploit could still affect older Samsung devices that may not have received the patches. The attack requires the targeted apps to be installed, which is common for flagship models. The full extent of the impact on budget models remains unclear, as does Samsung's official response to the detailed findings.