$50,000 Samsung Bixby Exploit Chain Yields Remote Code Execution on Galaxy Phones

Security researchers have detailed a multi-stage Samsung Bixby exploit chain that allowed attackers to achieve remote code execution at the highest privilege level on flagship Samsung Galaxy smartphones. Originally demonstrated at Pwn2Own Ireland in October 2025 by Dimitrios Valsamaras of Microsoft and Ken Gannon of Mobile Hacking Lab—earning a $50,000 bug bounty on a Samsung Galaxy S25—the research presented at Black Hat illustrates how chained vulnerabilities in preinstalled applications can completely undermine the Android permission model. By pivoting through trusted system apps, the exploit turns Samsung’s virtual assistant into a proxy to execute arbitrary commands and exfiltrate sensitive user data.

Mechanics of the Chained Attack

The attack begins with classic initial access engineering: convincing a user to click a single malicious link delivered via SMS, messaging platforms, or malvertising. Once opened, the exploit leverages three distinct vulnerabilities across preinstalled Samsung ecosystem applications to bridge unprivileged web interactions to privileged local execution:

1. Initial Redirection (CVE-2025-21079): The link triggers a flaw in the Samsung Members app—the preloaded community and diagnostic portal—forcing it to connect to an attacker-controlled web server.
2. App Inter-Process Pivoting: The malicious page served to Samsung Members forces the application to launch the Samsung Account app, which manages authentication across device services.
3. Account Hijacking (CVE-2025-58486): A secondary vulnerability forces the Samsung Account application to redirect its web context to another domain under attacker control.
4. Cross-Site Scripting to Assistant Invoke (CVE-2025-58487): The secondary attacker page exploits a stored/reflected XSS vulnerability within the Samsung Account context.

This XSS payload represents the critical pivot point. The Samsung Account application holds special system permissions that grant it direct access to an internal entry point inside Bixby—effectively acting as a authenticated key-holder to an unexposed “side entrance” of the assistant service. The injected script uses these elevated rights to invoke Bixby programmatically without requiring voice interaction or manual user confirmation.

Abusing Bixby Capsules for Remote Code Execution

Once execution context is transferred into Bixby, the exploit targets the internal framework underlying Samsung’s assistant features: the Capsule infrastructure. On Galaxy devices, a “Capsule” is a hidden background component inside an application that acts like a localized internal server. When a user issues voice commands (e.g., to create a calendar event, check diagnostic state, or send a message), Bixby translates the request into an internal API call and routes it to the targeted application’s Capsule to perform the actual task.

To prevent third-party app abuse, Android and Samsung enforce inter-process communication (IPC) restrictions ensuring that only Bixby can interact directly with these internal Capsules. However, because the researchers forced Bixby itself to issue the requests under the control of their XSS payload, those IPC restrictions were bypassed entirely.

By reverse-engineering the internal Capsule communications, the researchers were able to forge commands that instructed internal Capsules to perform unauthorized background operations. This granted the exploit chain full access to system-level privileges (UID 1000 / system privileges)—the highest level of access obtainable on standard consumer Android hardware without kernel-level exploits. At this level, an attacker achieves persistent remote code execution, full access to local storage, private application data databases, and device telemetry.

Impact and Vulnerable Devices

The exploit chain was validated in real-world testing across several flagship Samsung models, including the Galaxy S25, Galaxy S24, and Galaxy Flip 7. Because the attack relies on components built into Samsung’s core Android overlay, older flagship and mid-range devices running unpatched versions of Samsung Members, Samsung Account, and Bixby are also vulnerable, provided all three applications are installed on the target device.

In an enterprise environment, a vulnerability of this nature poses severe risk. An attacker obtaining system privileges on a mobile device can bypass standard application sandbox boundaries, harvest session tokens for enterprise SaaS tools, access encrypted messaging databases, and turn mobile endpoints into operational pivot points within corporate networks.

Patch Status and Remediation

Samsung released patches in late 2025 to break this exploit chain:

• Samsung Members (Nov 2025): Resolves CVE-2025-21079, stopping web link handlers from forcing arbitrary remote connections. Updating Samsung Members neutralizes the entry point of the chain.
• Samsung Account (Dec 2025): Resolves CVE-2025-58486 and CVE-2025-58487, patching the XSS vulnerability and stopping unauthorized deep-link pivoting into Bixby.

To secure targeted endpoints, Galaxy users and mobile device administrators must ensure that Samsung Members and Samsung Account are updated to their latest versions via the Galaxy Store. Devices actively receiving monthly software maintenance releases should apply the December 2025 or newer device firmware updates. For legacy or unmaintained devices where official app updates are unavailable, administrators should restrict untrusted link opening and evaluate enterprise mobility management (EMM) policies regarding unpatched consumer services.