176 Vulnerabilities Discovered in Samsung’s Pre‑Installed Android Apps

Vulnerability report overview

Oversecured published a GitHub repository containing 176 security issues discovered in Samsung’s pre‑installed Android applications between 2022 and 2025. All issues were disclosed through Samsung’s Vulnerability Disclosure Program and have been fixed. Samsung paid a total bounty of $163,475.

Research started in 2021 with a two‑week scan that found 17 bugs. The scope was later expanded to dozens of core system apps (Settings, FactoryCamera, Galaxy Themes, Samsung Cloud, SmartThings, Samsung Pay, etc.), reaching 176 findings.

Sample high‑severity findings (ordered by bounty)

SmartThings – User activity and event leakage – $13,770

FactoryCamera – Arbitrary file corruption with system privileges – $10,310

Galaxy Store / AppLinker – Intent redirection via install_complete broadcast – $7,230

Samsung Cloud – Auth token, purchase history, and credit‑card suffix leakage – $4,300

WindowManagerService – Forged S Pen gestures – $3,480

DualOutFocusViewer – Arbitrary code execution – $3,240

Galaxy Themes Service – Uninstall arbitrary apps with system privilege – $5,580

Vulnerability type distribution

Intent redirection – executes actions in the context of a higher‑privilege app

Arbitrary file read/write – reads or modifies system and app data

Content‑provider access – bypasses permissions to read other apps’ data

Token/credential leakage – exposes auth tokens, API keys, account info

SQL injection – database query injection

Generic XSS – cross‑site scripting in WebView

Privilege bypass – skips system permission checks

Remote code execution – runs arbitrary code on the device

Sensitive data leakage – leaks contacts, call logs, Wi‑Fi info, etc.

Repository access

The full technical details for all 176 vulnerabilities are in the public GitHub repository:

https://github.com/oversecured/Samsung_Vulnerabilities

git clone https://github.com/oversecured/Samsung_Vulnerabilities.git

Each vulnerability is stored in its own folder, for example:

001. Settings — Intent redirection with system privilege/

002. FactoryCamera — Corruption of arbitrary files with system privilege/

039. Samsung Cloud — Leakage of auth tokens, purchase history/