# Samsung Bixby Exploit Chain — System-Level RCE via Samsung Members, Samsung Account, and Capsule Bypass (CVE-2025-21079, CVE-2025-58486, CVE-2025-58487)

> At Pwn2Own Ireland (October 2025), researchers Dimitrios Valsamaras (Microsoft) and Ken Gannon (Mobile Hacking Lab) demonstrated a chain of five vulnerabilities across Samsung Members, Samsung Account, and Bixby Capsule infrastructure that achieves system-level remote code execution on Samsung Galaxy S25, S24, and Flip 7 devices via a single malicious link. Samsung released patches in November and December 2025 for the Samsung Members and Samsung Account flaws respectively.

- **Published:** 2026-08-05T00:00:00Z
- **Last reviewed:** 2026-08-05T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1901
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-samsung-bixby-pwn2own-rce-chain-tl-2026-1901.webp?v=5c17d99b (Threadlinqs threat intel: CVE-2025-21079 Samsung Bixby RCE Chain: Detection & IOCs (TL-2026-1901) — Critical severity, 4 IOCs, 9 detection rules.)
- **ID:** TL-2026-1901
- **Severity:** CRITICAL (CVSS 8.1)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 4
- **CVEs:** CVE-2025-21079, CVE-2025-58486, CVE-2025-58487, CVE-2026-21055

## Description

This exploit chain weaponizes Samsung's own pre-installed applications — Samsung Members (a support/diagnostics app), Samsung Account (a single-sign-on and account management service), and Bixby (the AI assistant) — against the device owner. The attack begins when a victim clicks a malicious link delivered via ads, messaging, or other web-based vectors.

The chain exploits three distinct CVEs. CVE-2025-21079 (CVSS 8.1, HIGH) in Samsung Members (< 5.5.01.3) is actually two related improper input validation flaws (ZDI-26-209 and ZDI-26-210): the first forces an open redirect to an attacker-controlled site, and the second exposes Samsung Members' WebView to a custom malicious URL, granting the attacker control over the app's navigation. From Samsung Members, the attacker leverages CVE-2025-58486 (improper input validation leading to XSS, CVSS 5.5, MEDIUM) and CVE-2025-58487 (improper authorization, CVSS 3.3, LOW) in Samsung Account (< 15.5.01.1) — the former injects arbitrary script into the Samsung Account WebView, while the latter launches arbitrary Android exported activities with Samsung Account's privileges.

The critical pivot point is that Samsung Account holds a special permission to interact with a specific entry point in Bixby — described by the researchers as a 'side entrance.' The XSS exploit forces Samsung Account to open Bixby through this privileged pathway. Once Bixby is opened under attacker control, the researchers exploit Bixby's Capsule infrastructure: hidden background services within apps that act as mini internal servers, normally accessible only to Bixby via voice commands. The researchers reverse-engineered this trust boundary and found a method to force Bixby to issue commands to Capsules in ways the system never intended, effectively weaponizing the assistant.

This Capsule abuse enables two critical capabilities: exfiltration of sensitive data stored on the device, and escalation to system-level permissions — the highest privilege level on a stock, unmodified consumer Android device — enabling full remote code execution and complete device takeover. The researchers successfully reproduced the chain on Samsung Galaxy S25, S24, and Flip 7 devices. Budget-model Galaxy devices may also be affected where the targeted pre-installed apps exist.

The findings were presented at Black Hat USA 2026 in a briefing titled 'One Click to System: Exploiting Bixby's Trust Model for Full Device Compromise.' No exploitation in the wild has been confirmed as of the advisory publication date. Samsung Members was patched in version 5.5.01.3 (November 2025 security update), and Samsung Account was patched in version 15.5.01.1 (December 2025 security update). A related but independently discovered Bixby vulnerability, CVE-2026-21055 (improper component export, CVSS 4.0 8.5), further demonstrates the attack surface of Bixby's exported components and was patched in Bixby 4.0.70.8.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1559 Inter-Process Communication
- T1548 Abuse Elevation Control Mechanism
- T1553 Subvert Trust Controls
- T1202 Indirect Command Execution
- T1218 System Binary Proxy Execution
- T1555 Credentials from Password Stores
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1565 Data Manipulation
- T1529 System Shutdown/Reboot

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Samsung Members WebView Open Redirect to External Domain** (`TL-2026-1901-SPL-001`)

Detects exploitation of CVE-2025-21079 (ZDI-26-209, ZDI-26-210) in Samsung Members app where the WebView is forced to perform an open redirect to an attacker-controlled external domain. The malicious link delivered via spearphishing triggers Samsung Members (com.samsung.android.app.members) to navigate its WebView to an arbitrary URL outside Samsung infrastructure, enabling the first stage of the exploit chain.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1566.002, T1204.001
- **Data sources:** samsung_knox_audit, web_proxy, android_device_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=knox_audit sourcetype=samsung:knox:audit
| search (Name="SUSPICIOUS_URL_ACCESSED" OR EventType="UrlAccess") PackageName="com.samsung.android.app.members"
| eval dest_domain=lower(UrlDomain)
| lookup samsung_whitelist_domains.csv domain as dest_domain OUTPUT is_authorized
| where is_authorized="false" OR isnull(is_authorized)
| eval threat_id="TL-2026-1901"
| table _time, DeviceModel, DeviceSerialNumber, PackageName, dest_domain, Url, EventTime, Severity, threat_id
| sort - _time
```

### Microsoft KQL

```kql
Samsung_Knox_Audit_CL
| where Name == "SUSPICIOUS_URL_ACCESSED"
| where PackageName == "com.samsung.android.app.members"
| extend dest_domain = tolower(tostring(parse_url(Url).Host))
| let samsung_domains = dynamic(["samsung.com", "account.samsung.com", "members.samsung.com", "galaxystore.samsung.com", "secb2b.samsung.com"]);
| where not (dest_domain has_any (samsung_domains))
| project TimeGenerated, DeviceModel, DeviceSerialNumber, PackageName, dest_domain, Url, EventTime, Severity, DeviceImei1
| order by TimeGenerated desc
```

### Sigma

```yaml
title: Samsung Members WebView Open Redirect to External Domain
id: b1a2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects Samsung Members WebView navigation to non-Samsung external domains, indicating exploitation of CVE-2025-21079 open redirect vulnerability
references:
    - https://www.zerodayinitiative.com/advisories/ZDI-26-209/
    - https://www.zerodayinitiative.com/advisories/ZDI-26-210/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-21079
author: Threadlinqs Team
date: 2026-08-05
tags:
    - attack.initial-access
    - attack.t1190
    - attack.t1566.002
    - attack.t1204.001
    - cve.2025.21079
logsource:
    product: android
    category: network
    service: knox_audit
detection:
    selection:
        Name: "SUSPICIOUS_URL_ACCESSED"
        PackageName: "com.samsung.android.app.members"
    filter_samsung:
        Url|contains:
            - "samsung.com"
            - "galaxystore.samsung.com"
    condition: selection and not filter_samsung
falsepositives:
    - Samsung Members accessing legitimate Samsung partner CDN resources outside primary domains
    - MDM-triggered Samsung Members update checks via alternate URLs
level: high
```

**Known false positives:**

- Samsung Members legitimate navigation to partner-hosted support content
- MDM-initiated remote diagnostics URLs not on standard Samsung domain list

**Tuning notes:** Maintain a whitelist of legitimate Samsung service domains (members.samsung.com, account.samsung.com, galaxystore.samsung.com, etc.). Adjust the external domain list per-organization. Consider adding proxy telemetry enrichment to correlate the initial malicious link delivery. Reduce sensitivity if legitimate partner CDN URLs trigger false positives.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Samsung Account WebView Unexpected Script Execution (XSS) (locked: unlock with TL Creds)
- Bixby CommandReceiver Exported Component Abuse (CVE-2026-21055) (locked: unlock with TL Creds)
- Cross-App Intent IPC Chaining — Members to Account to Bixby (locked: unlock with TL Creds)
- Custom URL Scheme Abuse — Samsung Members and Samsung Account Invocation from Untrusted Sources (locked: unlock with TL Creds)
- Bixby Capsule Hidden Service Inter-App IPC Without Voice Trigger (locked: unlock with TL Creds)
- System-Level Command Execution via Bixby Capsule Service Abuse (locked: unlock with TL Creds)
- Bixby Capsule Invocation Without Voice Command Origin (locked: unlock with TL Creds)
- Samsung App WebView Data Exfiltration to Unknown External Domains (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [How a $50,000 Exploit Chain Turned Bixby Against Samsung Phones](https://www.securityweek.com/how-a-50000-exploit-chain-turned-bixby-against-samsung-phones/)
- [ZDI-26-209: Samsung Galaxy S25 Samsung Members Open Redirect](https://www.zerodayinitiative.com/advisories/ZDI-26-209/)
- [ZDI-26-210: Samsung Galaxy S25 Samsung Members Security Feature Bypass](https://www.zerodayinitiative.com/advisories/ZDI-26-210/)
- [ZDI-26-224: Samsung Galaxy S25 Samsung Account Input Validation](https://www.zerodayinitiative.com/advisories/ZDI-26-224/)
- [Samsung Mobile Security Bulletin — November 2025](https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=11)
- [Samsung Mobile Security Bulletin — December 2025](https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=12)
- [NVD — CVE-2025-21079 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-21079)
- [NVD — CVE-2025-58486 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-58486)
- [NVD — CVE-2025-58487 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-58487)
- [Pwn2Own Ireland 2025 — Day Two Results](https://www.thezdi.com/blog/2025/10/22/pwn2own-ireland-2025-day-two-results)
- [BleepingComputer — Samsung Galaxy S25 Hacked at Pwn2Own Ireland 2025](https://www.bleepingcomputer.com/news/security/samsung-galaxy-s25-hacked-on-day-two-of-pwn2own-ireland-2025/)
- [GitHub Advisory — CVE-2025-21079](https://github.com/advisories/ghsa-vrx8-mx5x-r6qv)
- [Black Hat USA 2026 — One Click to System: Exploiting Bixby's Trust Model](https://blackhat.com/us-26/briefings/schedule/)
- [CVE-2026-21055 PoC — Samsung Bixby Improper Component Export](https://github.com/Hunt-Benito/samsung-bixby-command-execution-cve-2026-21055-improper-component-export)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1901