Security researchers have shown how a single attack can be built into an exploit chain that ultimately turns Samsung’s own services and virtual assistant against the victim. In their demonstration, an initial click led to a sequence of flaws—identified by multiple CVE entries—allowing the attacker to escalate from in-app interactions to the highest privilege level available on a stock Android device.
The work was presented after the researchers achieved success at the Pwn2Own Ireland hacking competition in October 2025. That achievement reportedly earned them $50,000 when they demonstrated the technique against a Samsung Galaxy S25 device. Later, the researchers outlined the full chain at Black Hat, describing how each vulnerability was linked to the next stage.
From a user click to the first compromised app
The attack begins with social engineering: an attacker tricks the targeted user into clicking a link. The link can be delivered through malicious ads or via a messaging application, so the victim’s interaction is the trigger that starts the technical steps that follow.
After the click, the researchers said a vulnerability tracked as CVE-2025-21079 is used to force the Samsung Members app to connect to a malicious website. Samsung Members is an official community and support-related application that is preloaded on many mid-range and flagship Galaxy phones.
From there, the malicious website takes another step. The researchers reported that it can force Samsung Members to open the Samsung Account app, which is used for connecting users to Samsung services.
Chaining vulnerabilities inside Samsung Account
Once Samsung Account is open, the exploit chain continues. The researchers described the use of a second vulnerability, CVE-2025-58486, to force Samsung Account to connect to an attacker-controlled website. In other words, the attacker is not just trying to cause a webpage to load; they are shaping the behavior of the app so it reaches the next stage under attacker direction.
The next link relies on a cross-site scripting issue tracked as CVE-2025-58487. According to the researchers, this XSS vulnerability can be used to force Samsung Account to open Bixby, Samsung’s virtual assistant.
At this point, the attack is no longer only about browser-style flaws. It is about using the trusted relationships between apps—starting with Samsung Account and ending at Bixby—to reach functionality that the attacker would otherwise struggle to invoke.
Why Samsung Account could “unlock” Bixby
The researchers explained that the key factor enabling this transition is a special permission used by the Samsung Account app. They said this permission is required for Samsung Account to interact with a specific “entry point” in Bixby.
In their explanation, they compared it to having a side door that only specific holders can open. Samsung Account acts as the “key holder” for that side entrance into Bixby’s relevant interface.
This matters because Bixby is designed to perform actions such as handling voice commands, running visual searches, and carrying out device automation routines. If an attacker can compel Bixby to open in a way that gives them control over what it executes, the risk quickly escalates.
Capsules: the hidden background service that does the work
The next stage of the exploit chain moves into Bixby’s internal mechanisms. Researchers described “Capsule” as a hidden background service inside an app that functions like a mini internal server. When a user issues a voice command, Bixby translates the request and sends it to the Capsule so the Capsule can perform the actual task.
Normally, Samsung restricts access to these Capsules so that only Bixby can communicate with them. The researchers reported that they reverse-engineered the Capsule infrastructure on Samsung phones and then found a way to force Bixby to use various Capsules maliciously.
By steering Bixby toward those Capsule actions, an attacker could exfiltrate sensitive data and obtain system-level permissions on the Android device. That system-level access is presented by the researchers as the highest privilege level achievable on a stock consumer Android configuration.
System permissions enable remote control
Once the attacker gains system permissions, the researchers said the door opens for additional compromise. They reported that system privileges allow remote code execution and device takeover.
In their demonstration details, they also said they successfully reproduced the exploit chain on multiple devices, including the Samsung Galaxy S25, S24, and the Flip 7. This suggests the behavior was not limited to a single model generation, at least before patches were applied.
What Samsung fixed—and when
After the Pwn2Own Ireland competition, Samsung began issuing fixes for the described vulnerabilities in phases. The researchers said patches started appearing a few weeks later.
They reported that Samsung released patches for the Samsung Members application in November 2025. Those updates were said to prevent the exploit chain from being triggered through a web browser or messaging application.
Then, in December, patches reportedly focused on the Samsung Account flaws—addressing the issues involved in forcing Samsung Account to connect to an attacker-controlled site and in the steps that ultimately influence Bixby interaction.
The researchers also cautioned that the attack can work on older Samsung devices that may not have received the required updates. They noted, however, that the exploit requires all of the targeted apps to be installed. While flagship models typically have these apps preinstalled, it was not clear to the researchers whether the same holds for budget models.
SecurityWeek reported that Samsung did not respond to its request for comment.
Why this case matters for mobile security
This demonstration highlights a common risk pattern in mobile ecosystems: when trusted components can be chained together, one weak point can turn into full control. The researchers did not rely on only one flaw; they described a carefully connected sequence where each vulnerability sets up the next behavior inside Samsung’s apps.
For users, the practical takeaway is straightforward: keep Galaxy devices updated, especially around app and system service patches. For defenders, the case shows the importance of reviewing not just individual CVEs, but also the permissions, app-to-app interactions, and internal service pathways that can turn separate issues into a complete takeover.
Conclusion
The researchers’ Black Hat presentation turned a successful hacking event into a detailed explanation of how an exploit chain can start from a malicious link and end with system-level compromise. By chaining vulnerabilities across Samsung Members, Samsung Account, and Bixby—while leveraging specialized permissions and internal Capsule services—the attack demonstrated how quickly a mobile device can be pushed from user interaction to remote control.
With patches reportedly released for the relevant app components in late 2025, the best protection remains timely updates. Still, the technique serves as a reminder that the security of a phone depends not only on fixing bugs, but also on limiting how apps can steer each other’s privileged actions.
Source: https://www.securityweek.com/how-a-50000-exploit-chain-turned-bixby-against-samsung-phones/
