Researchers used Bixby exploit chain to gain Galaxy system access
Two researchers chained vulnerabilities in Samsung Members, Samsung Account and Bixby to gain system-level control of Galaxy phones and won $50,000 at Pwn2Own Ireland.
Two security researchers demonstrated an exploit chain that achieved system-level control on Samsung Galaxy phones. They showed the attack at Pwn2Own Ireland in October 2025 and later outlined the technical steps in a presentation at Black Hat.
The work was carried out by Dimitrios Valsamaras, a senior security researcher at Microsoft, and Ken Gannon, head of mobile research at Mobile Hacking Lab. At Pwn2Own they used the chain to compromise a Samsung Galaxy S25 and collected a $50,000 reward. They later reproduced the full exploit on Galaxy S25, S24 and Flip 7 models.
The chain begins when a user clicks a malicious link delivered by an ad or a messaging app. That action triggers CVE-2025-21079 to make the Samsung Members app load an attacker-controlled website. Samsung Members is a preinstalled community, diagnostics and support app on many Galaxy devices.
The malicious site then forces Samsung Members to open the Samsung Account app. The researchers used CVE-2025-58486 to make Samsung Account contact an attacker-controlled page, which then exploited an XSS bug tracked as CVE-2025-58487 to instruct Samsung Account to open Bixby, the virtual assistant.
Ken Gannon described the Samsung Account permission involved as “a side entrance” that allows the app to reach a specific Bixby entry point. Once Bixby is invoked, the researchers targeted Bixby Capsules, which are background services inside apps that perform tasks when Bixby issues commands.
The team reverse-engineered the Capsule infrastructure and found ways to force Bixby to trigger Capsules with attacker-supplied input. Because Capsules can control app functions and access app data, manipulating them allowed the researchers to exfiltrate information and escalate privileges. By chaining the web-triggered bugs with Capsule misuse, the exploit reached the Android system permission level and enabled remote code execution on an unmodified consumer device.
Samsung released patches in the weeks after Pwn2Own. A November 2025 update for Samsung Members blocked the browser- and messaging-triggered entry point, and December updates addressed the Samsung Account vulnerabilities. The researchers noted the full exploit requires the targeted device to have all of the involved apps installed, and that older devices that have not received the patches remain at risk.
The researchers did not publish exploit code during their talk. Samsung did not provide a comment for this report.
Articles by this author
