NewsPublished 5 Aug 2026

How a $50,000 Exploit Chain Turned Bixby Against Samsung Phones

Source SecurityWeek

Mentions 3 CVEs

Mentioned vulnerabilities

Description

The chain involved the exploitation of several vulnerabilities in the Samsung Members and Samsung Account applications. The post How a $50,000 Exploit Chain Turned Bixby Against Samsung Phones appeared first on SecurityWeek .

Impact

Successful exploitation allows remote attackers to achieve system-level privileges on affected Samsung Galaxy devices, enabling full control including remote code execution and sensitive data exfiltration. This represents a critical compromise of device security. The exploit requires user interaction (clicking a malicious link) and the presence of vulnerable versions of Samsung Members, Samsung Account, and Bixby apps. Patched devices are protected; unpatched older devices remain at risk.

Defensive guidance

Samsung has released official patches for the vulnerabilities involved: Samsung Members was patched in November 2025 and Samsung Account in December 2025. Users should ensure their devices are updated with these patches to prevent exploitation. The exploit chain requires all targeted apps to be installed; removing or disabling these apps may reduce risk on unpatched devices. No additional vendor advisories indicate further mitigation steps. Patch status is confirmed by Samsung's rollout of updates.

Summary

Security researchers Dimitrios Valsamaras and Ken Gannon demonstrated a multi-stage exploit chain against Samsung Galaxy devices involving vulnerabilities in Samsung Members (CVE-2025-21079), Samsung Account (CVE-2025-58486, CVE-2025-58487), and Bixby. The attack begins by tricking a user into clicking a malicious link that forces Samsung Members to connect to an attacker-controlled site, which then coerces Samsung Account to connect to another malicious site. Exploiting an XSS vulnerability in Samsung Account allows forced interaction with Bixby, which has privileged access to internal Capsules—mini internal servers that perform app functions. By abusing this, attackers can exfiltrate data and gain system-level permissions, enabling remote code execution and full device control. The exploit was demonstrated on Galaxy S25, S24, and Flip 7 models. Samsung released patches for Samsung Members in November 2025 and for Samsung Account in December 2025, mitigating the exploit chain. Older devices without these patches remain vulnerable if the targeted apps are installed.

References

securityweek.com/how-a-50000-exploit-chain-turned-bixby-against-samsung-phones/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 5 Aug 2026, 19:41 UTC

References

Community reviews

Related threats