Skip to navigation

Threat reportVulnerabilityTL-2026-1901

Samsung Bixby Exploit Chain — System-Level RCE via Samsung Members, Samsung Account, and Capsule Bypass (CVE-2025-21079, CVE-2025-58486, CVE-2025-58487)

criticalPATCHED

At Pwn2Own Ireland (October 2025), researchers Dimitrios Valsamaras (Microsoft) and Ken Gannon (Mobile Hacking Lab) demonstrated a chain of five vulnerabilities across Samsung Members, Samsung Account, and Bixby Capsule infrastructure that achieves system-level remote code execution on Samsung Galaxy S25, S24, and Flip 7 devices via a single malicious link.

Key facts

IdentifiersTL-2026-1901, CVE-2025-21079, CVE-2025-58486, CVE-2025-58487, CVE-2026-21055
Also known asSummoning Team S25 Exploit, ZDI-26-209, ZDI-26-210, ZDI-26-224
SeverityCRITICAL
CVSS8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
EPSSCVE-2025-21079: 0.5% (45.2th percentile); CVE-2025-58486: 0.1% (8.2th percentile); CVE-2026-21055: 0.1% (5.6th percentile)
Affected productsSamsung Samsung Members; Samsung Samsung Account; Samsung Samsung Galaxy S25; Samsung Samsung Galaxy S24; Samsung Samsung Galaxy Z Flip 7; Samsung Samsung Bixby
Weaknesses (CWE)CWE-20, CWE-79, CWE-285, CWE-926
ToolsSamsung Account, Samsung Bixby, Samsung Members
MITRE ATT&CK techniquesT1005 Data from Local System, T1059 Command and Scripting Interpreter, T1071 Application Layer Protocol, T1190 Exploit Public-Facing Application, T1202 Indirect Command Execution, T1204 User Execution, T1218 System Binary Proxy Execution, T1529 System Shutdown/Reboot, T1548 Abuse Elevation Control Mechanism, T1553 Subvert Trust Controls, T1555 Credentials from Password Stores, T1559 Inter-Process Communication and 4 more in the attack flow
MotivationUNKNOWN
Target sectorsconsumer-electronics, enterprise, telecoms
Target regionsGlobal
Detection rules9 (1 shown free)
Sources14 cited sources

Detection coverage

As of 2026-08-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1901 across Splunk SPL, Microsoft KQL and Sigma, covering 4 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Samsung Members WebView Open Redirect to External Domain

Detects exploitation of CVE-2025-21079 (ZDI-26-209, ZDI-26-210) in Samsung Members app where the WebView is forced to perform an open redirect to an attacker-controlled external domain. The malicious link delivered via spearphishing triggers Samsung Members (com.samsung.android.app.members) to navigate its WebView to an arbitrary URL outside Samsung infrastructure, enabling the first stage of the exploit chain.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1566.002, T1204.001
  • Data sources: samsung_knox_audit, web_proxy, android_device_logs
  • Severity: high
  • Confidence: high

Splunk SPL

index=knox_audit sourcetype=samsung:knox:audit
| search (Name="SUSPICIOUS_URL_ACCESSED" OR EventType="UrlAccess") PackageName="com.samsung.android.app.members"
| eval dest_domain=lower(UrlDomain)
| lookup samsung_whitelist_domains.csv domain as dest_domain OUTPUT is_authorized
| where is_authorized="false" OR isnull(is_authorized)
| eval threat_id="TL-2026-1901"
| table _time, DeviceModel, DeviceSerialNumber, PackageName, dest_domain, Url, EventTime, Severity, threat_id
| sort - _time

Microsoft KQL

Samsung_Knox_Audit_CL
| where Name == "SUSPICIOUS_URL_ACCESSED"
| where PackageName == "com.samsung.android.app.members"
| extend dest_domain = tolower(tostring(parse_url(Url).Host))
| let samsung_domains = dynamic(["samsung.com", "account.samsung.com", "members.samsung.com", "galaxystore.samsung.com", "secb2b.samsung.com"]);
| where not (dest_domain has_any (samsung_domains))
| project TimeGenerated, DeviceModel, DeviceSerialNumber, PackageName, dest_domain, Url, EventTime, Severity, DeviceImei1
| order by TimeGenerated desc

Sigma

title: Samsung Members WebView Open Redirect to External Domain
id: b1a2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects Samsung Members WebView navigation to non-Samsung external domains, indicating exploitation of CVE-2025-21079 open redirect vulnerability
references:
    - https://www.zerodayinitiative.com/advisories/ZDI-26-209/
    - https://www.zerodayinitiative.com/advisories/ZDI-26-210/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-21079
author: Threadlinqs Team
date: 2026-08-05
tags:
    - attack.initial-access
    - attack.t1190
    - attack.t1566.002
    - attack.t1204.001
    - cve.2025.21079
logsource:
    product: android
    category: network
    service: knox_audit
detection:
    selection:
        Name: "SUSPICIOUS_URL_ACCESSED"
        PackageName: "com.samsung.android.app.members"
    filter_samsung:
        Url|contains:
            - "samsung.com"
            - "galaxystore.samsung.com"
    condition: selection and not filter_samsung
falsepositives:
    - Samsung Members accessing legitimate Samsung partner CDN resources outside primary domains
    - MDM-triggered Samsung Members update checks via alternate URLs
level: high

Known false positives:

  • Samsung Members legitimate navigation to partner-hosted support content
  • MDM-initiated remote diagnostics URLs not on standard Samsung domain list

Tuning notes: Maintain a whitelist of legitimate Samsung service domains (members.samsung.com, account.samsung.com, galaxystore.samsung.com, etc.). Adjust the external domain list per-organization. Consider adding proxy telemetry enrichment to correlate the initial malicious link delivery. Reduce sensitivity if legitimate partner CDN URLs trigger false positives.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Samsung Account WebView Unexpected Script Execution (XSS) · unlock with TL Creds
  • Bixby CommandReceiver Exported Component Abuse (CVE-2026-21055) · unlock with TL Creds
  • Cross-App Intent IPC Chaining — Members to Account to Bixby · unlock with TL Creds
  • Custom URL Scheme Abuse — Samsung Members and Samsung Account Invocation from Untrusted Sources · unlock with TL Creds
  • Bixby Capsule Hidden Service Inter-App IPC Without Voice Trigger · unlock with TL Creds
  • System-Level Command Execution via Bixby Capsule Service Abuse · unlock with TL Creds
  • Bixby Capsule Invocation Without Voice Command Origin · unlock with TL Creds
  • Samsung App WebView Data Exfiltration to Unknown External Domains · unlock with TL Creds

Indicators of compromise

As of 2026-08-05, Threadlinqs Intelligence tracks 4 indicators of compromise for TL-2026-1901.

4 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Samsung released patches in November and December 2025 for the Samsung Members and Samsung Account flaws respectively.

This exploit chain weaponizes Samsung's own pre-installed applications — Samsung Members (a support/diagnostics app), Samsung Account (a single-sign-on and account management service), and Bixby (the AI assistant) — against the device owner. The attack begins when a victim clicks a malicious link delivered via ads, messaging, or other web-based vectors.

The chain exploits three distinct CVEs. CVE-2025-21079 (CVSS 8.1, HIGH) in Samsung Members (< 5.5.01.3) is actually two related improper input validation flaws (ZDI-26-209 and ZDI-26-210): the first forces an open redirect to an attacker-controlled site, and the second exposes Samsung Members' WebView to a custom malicious URL, granting the attacker control over the app's navigation. From Samsung Members, the attacker leverages CVE-2025-58486 (improper input validation leading to XSS, CVSS 5.5, MEDIUM) and CVE-2025-58487 (improper authorization, CVSS 3.3, LOW) in Samsung Account (< 15.5.01.1) — the former injects arbitrary script into the Samsung Account WebView, while the latter launches arbitrary Android exported activities with Samsung Account's privileges.

The critical pivot point is that Samsung Account holds a special permission to interact with a specific entry point in Bixby — described by the researchers as a 'side entrance.' The XSS exploit forces Samsung Account to open Bixby through this privileged pathway. Once Bixby is opened under attacker control, the researchers exploit Bixby's Capsule infrastructure: hidden background services within apps that act as mini internal servers, normally accessible only to Bixby via voice commands. The researchers reverse-engineered this trust boundary and found a method to force Bixby to issue commands to Capsules in ways the system never intended, effectively weaponizing the assistant.

This Capsule abuse enables two critical capabilities: exfiltration of sensitive data stored on the device, and escalation to system-level permissions — the highest privilege level on a stock, unmodified consumer Android device — enabling full remote code execution and complete device takeover. The researchers successfully reproduced the chain on Samsung Galaxy S25, S24, and Flip 7 devices. Budget-model Galaxy devices may also be affected where the targeted pre-installed apps exist.

The findings were presented at Black Hat USA 2026 in a briefing titled 'One Click to System: Exploiting Bixby's Trust Model for Full Device Compromise.' No exploitation in the wild has been confirmed as of the advisory publication date. Samsung Members was patched in version 5.5.01.3 (November 2025 security update), and Samsung Account was patched in version 15.5.01.1 (December 2025 security update). A related but independently discovered Bixby vulnerability, CVE-2026-21055 (improper component export, CVSS 4.0 8.5), further demonstrates the attack surface of Bixby's exported components and was patched in Bixby 4.0.70.8.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution; T1559 Inter-Process Communication

Command and Control

T1071 Application Layer Protocol

Initial Access

T1190 Exploit Public-Facing Application; T1566 Phishing

Defense Evasion

T1202 Indirect Command Execution; T1218 System Binary Proxy Execution

Impact

T1529 System Shutdown/Reboot; T1565 Data Manipulation

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

defense-impairment

T1553 Subvert Trust Controls

Credential Access

T1555 Credentials from Password Stores

Exfiltration

T1567 Exfiltration Over Web Service

Remediation

Patches

  • Samsung Members 5.5.01.3 (November 2025 SMR)
  • Samsung Account 15.5.01.1 (December 2025 SMR)
  • Bixby 4.0.70.8 (July 2026 SMR — for CVE-2026-21055)

Immediate actions

  • Update Samsung Members to version 5.5.01.3 or later via Galaxy Store
  • Update Samsung Account to version 15.5.01.1 or later via Galaxy Store
  • Apply Samsung November 2025 and December 2025 security maintenance releases on all Galaxy devices
  • Verify monthly Samsung Security Bulletin compliance on all fleet devices

Workarounds

  • Disable or uninstall Samsung Members if not required for support workflows
  • Restrict installation of Samsung Account/Bixby on managed enterprise profiles
  • Educate users not to click links from untrusted sources on Galaxy devices
  • Block Samsung Members and Samsung Account network access via mobile firewall where feasible

Longer-term hardening

  • Implement mobile device management (MDM) policies enforcing regular Samsung security updates
  • Assess reliance on pre-installed Samsung applications for enterprise deployments
  • Review Android intent-based attack surface for zero-trust posture on managed devices
  • Deploy EDR/MDM capable of detecting anomalous inter-app IPC on Samsung devices

Affected and fixed versions

  • Samsung — Samsung Members
    Vulnerable versions: <5.5.01.3
    Fixed in: 5.5.01.3
  • Samsung — Samsung Account
    Vulnerable versions: <15.5.01.1
    Fixed in: 15.5.01.1
  • Samsung — Samsung Galaxy S25
    Vulnerable versions: All versions without November/December 2025 SMR
    Fixed in: SMR November 2025+
  • Samsung — Samsung Galaxy S24
    Vulnerable versions: All versions without November/December 2025 SMR
    Fixed in: SMR November 2025+
  • Samsung — Samsung Galaxy Z Flip 7
    Vulnerable versions: All versions without November/December 2025 SMR
    Fixed in: SMR November 2025+
  • Samsung — Samsung Bixby
    Vulnerable versions: <4.0.70.8
    Fixed in: 4.0.70.8

Timeline

  • Pavlo Fedorenko reported CVE-2025-21077, a related Samsung Email vulnerability, demonstrating Samsung's systemic Android intent-handling weaknesses
  • Voorivex Team reported CVE-2025-58485, a Bixby Launcher uXSS vulnerability in Samsung Browser, highlighting the broader Bixby attack surface
  • Exploit chain demonstrated at Pwn2Own Ireland 2025 (Day Two) by Ken Gannon (Mobile Hacking Lab) and Dimitrios Valsamaras (Summoning Team/Microsoft), earning $50,000 and 5 Master of Pwn points. Samsung Galaxy S25 compromised via chain of five bugs
  • Samsung Account vulnerabilities (CVE-2025-58486, CVE-2025-58487) reported to Samsung via Zero Day Initiative coordination
  • Samsung November 2025 Security Maintenance Release deployed. Samsung Members updated to version 5.5.01.3, patching CVE-2025-21079 via removal of unnecessary implementation
  • Samsung Members vulnerabilities (CVE-2025-21079 / ZDI-26-209, ZDI-26-210) formally reported to Samsung by Gannon and Valsamaras via ZDI
  • Samsung December 2025 Security Maintenance Release deployed. Samsung Account updated to version 15.5.01.1, patching both CVE-2025-58486 (improper input validation/XSS) and CVE-2025-58487 (improper authorization/activity launch)
  • Voorivex Team awarded $2,700 bounty for CVE-2025-58485 (Bixby Launcher uXSS), a related Bixby attack vector
  • ZDI publicly disclosed Samsung Members advisories ZDI-26-209 and ZDI-26-210 (both CVE-2025-21079) after 90-day embargo post-Pwn2Own
  • ZDI publicly disclosed Samsung Account advisory ZDI-26-224 (CVE-2025-58486) after coordinated disclosure period
  • CVE-2026-21055 published: Samsung Bixby improper component export (CVSS 4.0 8.5, HIGH) discovered by Tianyi Hu, allowing arbitrary command execution with Bixby privilege via exported CommandReceiver component. Patched in Bixby 4.0.70.8
  • Black Hat USA 2026 briefing: 'One Click to System: Exploiting Bixby's Trust Model for Full Device Compromise' presented by Dimitrios Valsamaras and Ken Gannon, detailing the full exploit chain and Capsule reverse-engineering methodology
  • SecurityWeek published detailed technical analysis of the exploit chain, confirming successful reproduction on Galaxy S25, S24, and Flip 7. No active in-the-wild exploitation reported

Sources cited

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 14 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats