[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-93383":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":15,"subscribersCount":15,"size":15,"stars1d":16,"stars7d":17,"stars30d":17,"stars90d":15,"forks30d":15,"starsTrendScore":18,"compositeScore":19,"rankGlobal":10,"rankLanguage":10,"license":20,"archived":21,"fork":21,"defaultBranch":22,"hasWiki":21,"hasPages":21,"topics":23,"createdAt":10,"pushedAt":10,"updatedAt":27,"readmeContent":28,"aiSummary":29,"trendingCount":15,"starSnapshotCount":15,"syncStatus":30,"lastSyncTime":31,"discoverSource":32},93383,"Samsung_Vulnerabilities","oversecured\u002FSamsung_Vulnerabilities","oversecured","176 vulnerabilities in Samsung preinstalled Android apps","",null,"Java",283,70,1,0,14,84,58,93.95,"BSD 2-Clause \"Simplified\" License",false,"main",[24,25,26],"android","security","vulnerability-disclosure","2026-07-22 04:02:09","# Responsible disclosure report 2022-2025 - Oversecured found 176 vulnerabilities in Samsung preinstalled apps\n\nOversecured is a leading mobile security provider specializing in detecting vulnerabilities in Android and iOS apps. \n\nOur team at Oversecured shares global security values and strives to continuously improve our mobile app scanning technology to ensure its excellence.\n\nIn this article, we share 176 vulnerabilities that we discovered and worked with Samsung to fix throughout our collaboration, including detailed descriptions of 140 of them.\n\nWe at Oversecured are incredibly proud of our collaboration with Samsung in making mobile apps more secure. Our strong partnership with Samsung allows us to work together toward improving global mobile security. \n\nAlso, our results demonstrate the capability of our scanner to handle most vulnerabilities where others may fall short. Let’s take a closer look at what we have achieved.\n\n## Introduction\n\nSamsung is a leading global electronics company making popular mobile devices based on Android. \nAs a company with a wide range of products, it is unsurprising that they have a vast amount of software code to maintain. \n\nSamsung has one of the most competent cybersecurity teams in the industry, consistently working to improve its security measures. They have implemented various measures to ensure the safety of their users, including a [vulnerability disclosure program](https:\u002F\u002Fsecurity.samsungmobile.com\u002FsecurityReporting.smsb) and regular security audits.\n\nIn 2021, Oversecured already conducted a [two-week research](https:\u002F\u002Fblog.oversecured.com\u002FTwo-weeks-of-securing-Samsung-devices-Part-1\u002F) on Samsung's system app security, which resulted in the discovery of 17 vulnerabilities. We were happy to help Samsung to identify and fix these vulnerabilities, ensuring that their products remain secure for their mobile device users.\n\nOur research 2022-2025 uncovered risky vulnerabilities in Samsung's mobile apps, and we promptly reported them to Samsung's VDP team. We were impressed by Samsung's quick response and efficient handling of the vulnerabilities we reported. As a result, millions of Samsung users can rest assured that their devices are now as secure as those running on AOSP. More details about our research can be found in our [previous article](https:\u002F\u002Fblog.oversecured.com\u002FDiscovering-vendor-specific-vulnerabilities-in-Android\u002F).\n\n\n## List of vulnerabilities\n\nThere is a list of vulnerabilities we have found through our research. All of these vulnerabilities are already fixed with our help.\n\nThe vulnerabilities are sorted by date of report and fix. When this article was published, Samsung had rewarded the Oversecured team **$163.475** and ranked first in their [security research ranking](https:\u002F\u002Fsecurity.samsungmobile.com\u002FhallOfFameInfo.smsb).\n\nWe also selected some of the most exciting vulnerabilities and described them in [a separate article](https:\u002F\u002Fblog.oversecured.com\u002F) on the Oversecured blog.\n\n| #   | App                         | Description                                                                                                                                                                                                                                                                                                                       | Reward |\n| --- | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ |\n| 1   | Settings                    | [Intent redirection with system privilege](001.%20Settings%20%E2%80%94%20Intent%20redirection%20with%20system%20privilege)                                                                                                                                                                                                        | $4850  |\n| 2   | FactoryCamera               | [Corruption of arbitrary files with system privilege](002.%20FactoryCamera%20%E2%80%94%20Corruption%20of%20arbitrary%20files%20with%20system%20privilege)                                                                                                                                                                         | $10310 |\n| 3   | Galaxy Themes Service       | [Uninstalling arbitrary apps](003.%20Galaxy%20Themes%20Service%20%E2%80%94%20Uninstalling%20arbitrary%20apps)                                                                                                                                                                                                                     | $5580  |\n| 4   | Galaxy Themes Service       | [Directory listing with system privilege](004.%20Galaxy%20Themes%20Service%20%E2%80%94%20Directory%20listing%20with%20system%20privilege)                                                                                                                                                                                         | $2610  |\n| 5   | Galaxy Store, AppLinker     | [Intent redirection via `install_complete` broadcast](005.%20Galaxy%20Store%2C%20AppLinker%20%E2%80%94%20Intent%20redirection%20via%20install_complete%20broadcast)                                                                                                                                                               | $7230  |\n| 6   | Galaxy Store                | [Overwriting of arbitrary files](006.%20Galaxy%20Store%20%E2%80%94%20Overwriting%20of%20arbitrary%20files)                                                                                                                                                                                                                        | $1850  |\n| 7   | EsimClient                  | [Opening arbitrary URLs within the app](007.%20EsimClient%20%E2%80%94%20Opening%20arbitrary%20URLs%20within%20the%20app)                                                                                                                                                                                                          | $200   |\n| 8   | Call settings               | [Changing preferred network type](008.%20Call%20settings%20%E2%80%94%20Changing%20preferred%20network%20type)                                                                                                                                                                                                                     | $3200  |\n| 9   | Contacts Storage            | [Theft and overwrite of arbitrary files via `CallLogProvider`](009.%20Contacts%20Storage%20%E2%80%94%20Theft%20and%20overwrite%20of%20arbitrary%20files%20via%20CallLogProvider)                                                                                                                                                  | $530   |\n| 10  | Galaxy Themes               | [Token leakage](010.%20Galaxy%20Themes%20%E2%80%94%20Token%20leakage)                                                                                                                                                                                                                                                             | $980   |\n| 11  | Phone                       | [Leakage of contact details](011.%20Phone%20%E2%80%94%20Leakage%20of%20contact%20details)                                                                                                                                                                                                                                         | $2580  |\n| 12  | CallBGProvider              | [Overwriting arbitrary files as UID `android.uid.phone`](012.%20CallBGProvider%20%E2%80%94%20Overwriting%20arbitrary%20files%20as%20UID%20android.uid.phone)                                                                                                                                                                      | $530   |\n| 13  | CallBGProvider              | [Gaining access to arbitrary\\* content providers as UID `android.uid.phone`](013.%20CallBGProvider%20%E2%80%94%20Gaining%20access%20to%20arbitrary*%20content%20providers%20as%20UID%20android.uid.phone)                                                                                                                         | $1050  |\n| 14  | CSC                         | [Disclosure of Wi-Fi connection info](014.%20CSC%20%E2%80%94%20Disclosure%20of%20Wi-Fi%20connection%20info)                                                                                                                                                                                                                       | $2610  |\n| 15  | DualOutFocusViewer          | [Arbitrary code execution](015.%20Live%20focus%20%E2%80%94%20Arbitrary%20code%20execution)                                                                                                                                                                                                                                        | $3240  |\n| 16  | Game Optimizing Service     | [Improper privilege management](016.%20Game%20Optimizing%20Service%20%E2%80%94%20Improper%20privilege%20management)                                                                                                                                                                                                               | $2250  |\n| 17  | Samsung Galaxy Friends      | [Intent redirection](017.%20Samsung%20Galaxy%20Friends%20%E2%80%94%20Intent%20redirection)                                                                                                                                                                                                                                        | $1600  |\n| 18  | Nearby Service              | [Leakage of connected devices and shared files](018.%20Nearby%20Service%20%E2%80%94%20Leakage%20of%20connected%20devices%20and%20shared%20files)                                                                                                                                                                                  | $350   |\n| 19  | Link to Windows Service     | [Locking the device](019.%20Link%20to%20Windows%20Service%20%E2%80%94%20Locking%20the%20device)                                                                                                                                                                                                                                   | $980   |\n| 20  | Group Sharing               | [Interacting with `MobileServiceSocialService` and performing arbitrary actions on the user's behalf](020.%20Group%20Sharing%20%E2%80%94%20Interacting%20with%20MobileServiceSocialService%20and%20performing%20arbitrary%20actions%20on%20the%20user's%20behalf)                                                                 | $970   |\n| 21  | Group Sharing               | [Disclose of phone-related info such as IMSI and MSISDN](021.%20Group%20Sharing%20%E2%80%94%20Disclose%20of%20phone-related%20info%20such%20as%20IMSI%20and%20MSISDN)                                                                                                                                                             | $680   |\n| 22  | Configuration update        | [Bypassing system permissions and accessing `ConfigProvider` data](022.%20Configuration%20update%20%E2%80%94%20Bypassing%20system%20permissions%20and%20accessing%20ConfigProvider%20data)                                                                                                                                        | $330   |\n| 23  | Smart View                  | [Leakage of connection data about streamed devices](023.%20Smart%20View%20%E2%80%94%20Leakage%20of%20connection%20data%20about%20streamed%20devices)                                                                                                                                                                              | $720   |\n| 24  | Video Trimmer               | [Gaining access to arbitrary\\* content providers via `MultiGridActivity`](024.%20Video%20Trimmer%20%E2%80%94%20Gaining%20access%20to%20arbitrary*%20content%20providers%20via%20MultiGridActivity)                                                                                                                                | $290   |\n| 25  | Samsung Billing             | [Universal-XSS](025.%20Samsung%20Checkout%20%E2%80%94%20Universal-XSS)                                                                                                                                                                                                                                                            | $980   |\n| 26  | Samsung Billing             | [SQL injection in `IAPService`](026.%20Samsung%20Checkout%20%E2%80%94%20SQL%20injection%20in%20IAPService)                                                                                                                                                                                                                        | $510   |\n| 27  | DeX for PC                  | [Gaining access to arbitrary\\* content providers with system privilege](027.%20DeX%20for%20PC%20%E2%80%94%20Gaining%20access%20to%20arbitrary*%20content%20providers%20with%20system%20privilege)                                                                                                                                 | $2160  |\n| 28  | PersonaManagerService       | [Listing user profiles with full info](028.%20PersonaManagerService%20%E2%80%94%20Listing%20user%20profiles%20with%20full%20info)                                                                                                                                                                                                 | $330   |\n| 29  | PersonaManagerService       | [Adding arbitrary package names to the white list](029.%20PersonaManagerService%20%E2%80%94%20Adding%20arbitrary%20package%20names%20to%20the%20white%20list)                                                                                                                                                                     | $3200  |\n| 30  | AccessibilityManagerService | [Changing magnifier positions](030.%20AccessibilityManagerService%20%E2%80%94%20Changing%20magnifier%20positions)                                                                                                                                                                                                                 | $480   |\n| 31  | DeX for PC                  | [Connecting to arbitrary PCs and sharing the device screen](031.%20DeX%20for%20PC%20%E2%80%94%20Connecting%20to%20arbitrary%20PCs%20and%20sharing%20the%20device%20screen)                                                                                                                                                        | $2120  |\n| 32  | Cameralyzer                 | [Theft of arbitrary files via a local web server](032.%20Cameralyzer%20%E2%80%94%20Theft%20of%20arbitrary%20files%20via%20a%20local%20web%20server)                                                                                                                                                                               | $600   |\n| 33  | FactoryCamera               | [Automatically launching camera and recording video](033.%20FactoryCamera%20%E2%80%94%20Automatically%20launching%20camera%20and%20recording%20video)                                                                                                                                                                             | $1910  |\n| 34  | Photo Editor                | [Gaining access to arbitrary\\* content providers](034.%20Photo%20Editor%20%E2%80%94%20Gaining%20access%20to%20arbitrary*%20content%20providers)                                                                                                                                                                                   | $860   |\n| 35  | Samsung DeX System UI       | [Enabling and disabling arbitrary components](035.%20Samsung%20DeX%20System%20UI%20%E2%80%94%20Enabling%20and%20disabling%20arbitrary%20components)                                                                                                                                                                               | $1680  |\n| 36  | Calendar                    | [Reading calendar data](036.%20Calendar%20%E2%80%94%20Reading%20calendar%20data)                                                                                                                                                                                                                                                  | $980   |\n| 37  | Game Launcher               | [Leakage of a Discord access token](037.%20Game%20Launcher%20%E2%80%94%20Leakage%20of%20a%20Discord%20access%20token)                                                                                                                                                                                                             | $1050  |\n| 38  | Quick Share                 | [Bypassing permissions to `SimpleSharingExportService` and stealing arbitrary files, contacts, and data from arbitrary providers](038.%20Quick%20Share%20%E2%80%94%20Bypassing%20permissions%20to%20SimpleSharingExportService%20and%20stealing%20arbitrary%20files%2C%20contacts%2C%20and%20data%20from%20arbitrary%20providers) | $810   |\n| 39  | Samsung Cloud               | [Leakage of auth tokens, purchase history, and last 4 numbers of credit card](039.%20Samsung%20Cloud%20%E2%80%94%20Leakage%20of%20auth%20tokens%2C%20purchase%20history%2C%20and%20last%204%20numbers%20of%20credit%20card)                                                                                                       | $4300  |\n| 40  | Bixby Vision                | [Theft of arbitrary files](040.%20Bixby%20Vision%20%E2%80%94%20Theft%20of%20arbitrary%20files)                                                                                                                                                                                                                                    | $1180  |\n| 41  | One UI Home                 | [Overwriting of arbitrary files](041.%20One%20UI%20Home%20%E2%80%94%20Overwriting%20of%20arbitrary%20files)                                                                                                                                                                                                                       | $1050  |\n| 42  | Video Editor                | [Theft of arbitrary files](042.%20Video%20Editor%20%E2%80%94%20Theft%20of%20arbitrary%20files)                                                                                                                                                                                                                                    | $1050  |\n| 43  | Samsung account             | [Gaining access to arbitrary\\* content providers](043.%20Samsung%20account%20%E2%80%94%20Gaining%20access%20to%20arbitrary*%20content%20providers)                                                                                                                                                                                | $1120  |\n| 44  | Contacts                    | [Leakage of contact data](044.%20Contacts%20%E2%80%94%20Leakage%20of%20contact%20data)                                                                                                                                                                                                                                            | $960   |\n| 45  | Samsung Health              | [Intent redirection](045.%20Samsung%20Health%20%E2%80%94%20Intent%20redirection)                                                                                                                                                                                                                                                  | $200   |\n| 46  | Samsung Internet Browser    | [Leakage of picked bookmarks and history URLs](046.%20Samsung%20Internet%20Browser%20%E2%80%94%20Leakage%20of%20picked%20bookmarks%20and%20history%20URLs)                                                                                                                                                                        | $300   |\n| 47  | Charm by Samsung            | [Leakage of connected health devices](047.%20Charm%20by%20Samsung%20%E2%80%94%20Leakage%20of%20connected%20health%20devices)                                                                                                                                                                                                      | $600   |\n| 48  | Charm by Samsung            | [Disclosing connected health device states](048.%20Charm%20by%20Samsung%20%E2%80%94%20Disclosing%20connected%20health%20device%20states)                                                                                                                                                                                          | $2120  |\n| 49  | Samsung Email               | [Gaining access to arbitrary\\* content providers via `MessageCompose` activity](049.%20Samsung%20Email%20%E2%80%94%20Gaining%20access%20to%20arbitrary*%20content%20providers%20via%20MessageCompose%20activity)                                                                                                                  | $1850  |\n| 50  | Galaxy Wearable             | [Token leakage on non-Samsung devices](050.%20Galaxy%20Wearable%20%E2%80%94%20Token%20leakage%20on%20non-Samsung%20devices)                                                                                                                                                                                                       | $1460  |\n| 51  | Knox VPN Services           | [Gaining access to arbitrary\\* content providers with system privilege](051.%20Knox%20VPN%20Services%20%E2%80%94%20Gaining%20access%20to%20arbitrary*%20content%20providers%20with%20system%20privilege)                                                                                                                          | $1150  |\n| 52  | SmartThings                 | [Remote token leakage](052.%20SmartThings%20%E2%80%94%20Remote%20token%20leakage)                                                                                                                                                                                                                                                 | $4310  |\n| 53  | SmartThings                 | [Leakage of device info, settings, and auth tokens](053.%20SmartThings%20%E2%80%94%20Leakage%20of%20device%20info%2C%20settings%2C%20and%20auth%20tokens)                                                                                                                                                                         | $3260  |\n| 54  | SmartThings                 | [Leakage of user activity and events](054.%20SmartThings%20%E2%80%94%20Leakage%20of%20user%20activity%20and%20events)                                                                                                                                                                                                             | $13770 |\n| 55  | SmartThings                 | [Gaining access to arbitrary\\* content providers leading to theft and write of arbitrary files](055.%20SmartThings%20%E2%80%94%20Gaining%20access%20to%20arbitrary*%20content%20providers%20leading%20to%20theft%20and%20write%20of%20arbitrary%20files)                                                                          | $900   |\n| 56  | Samsung Pay                 | [Gaining access to arbitrary\\* content providers](056.%20Samsung%20Pay%20%E2%80%94%20Gaining%20access%20to%20arbitrary*%20content%20providers)                                                                                                                                                                                    | $6340  |\n| 57  | Samsung Members             | [Intent redirection](057.%20Samsung%20Members%20%E2%80%94%20Intent%20redirection)                                                                                                                                                                                                                                                 | $1600  |\n| 58  | Samsung Notes               | [Overwriting of arbitrary files](058.%20Samsung%20Notes%20%E2%80%94%20Overwriting%20of%20arbitrary%20files)                                                                                                                                                                                                                       | $1180  |\n| 59  | Camera                      | [Gaining access to arbitrary\\* content providers](059.%20Camera%20%E2%80%94%20Gaining%20access%20to%20arbitrary*%20content%20providers)                                                                                                                                                                                           | $390   |\n| 60  | Samsung Internet Browser    | [Theft of arbitrary files](060.%20Samsung%20Internet%20Browser%20%E2%80%94%20Theft%20of%20arbitrary%20files)                                                                                                                                                                                                                      | $1050  |\n| 61  | IImsService                 | [Changing telecom preferences](061.%20IImsService%20%E2%80%94%20Changing%20telecom%20preferences)                                                                                                                                                                                                                                 | $220   |\n| 62  | MiscPolicy                  | [Cleaning MDM proxies](062.%20MiscPolicy%20%E2%80%94%20Cleaning%20MDM%20proxies)                                                                                                                                                                                                                                                  | $440   |\n| 63  | MiscPolicy                  | [Retrieving proxy config including auth info](063.%20MiscPolicy%20%E2%80%94%20Retrieving%20proxy%20config%20including%20auth%20info)                                                                                                                                                                                              | $440   |\n| 64  | BackupManagerService        | [Checking if the backup is enabled](064.%20BackupManagerService%20%E2%80%94%20Checking%20if%20the%20backup%20is%20enabled)                                                                                                                                                                                                        | $200   |\n| 65  | SemTelephonyServiceImpl     | [Enabling and disabling 2G](065.%20SemTelephonyServiceImpl%20%E2%80%94%20Enabling%20and%20disabling%202G)                                                                                                                                                                                                                         | $500   |\n| 66  | SemTelephonyServiceImpl     | [Changing ESP LOCI before permission is checked](066.%20SemTelephonyServiceImpl%20%E2%80%94%20Changing%20ESP%20LOCI%20before%20permission%20is%20checked)                                                                                                                                                                         | $250   |\n| 67  | SemTelephonyServiceImpl     | [Changing GBA values with `READ_PHONE_STATE` permission](067.%20SemTelephonyServiceImpl%20%E2%80%94%20Changing%20GBA%20values%20with%20READ_PHONE_STATE%20permission)                                                                                                                                                             | $250   |\n| 68  | DevicePolicyManagerService  | [Enabling and disabling simple password](068.%20DevicePolicyManagerService%20%E2%80%94%20Enabling%20and%20disabling%20simple%20password)                                                                                                                                                                                          | $200   |\n| 69  | UiccPhoneBookController     | [Reading Likes and SIM capacities](069.%20UiccPhoneBookController%20%E2%80%94%20Reading%20Likes%20and%20SIM%20capacities)                                                                                                                                                                                                         | $1180  |\n| 70  | WindowManagerService        | [Faking S pen gestures](070.%20WindowManagerService%20%E2%80%94%20Faking%20S%20pen%20gestures)                                                                                                                                                                                                                                    | $3480  |\n| 71  | DisplayManagerService       | [Reading connected DLNA device](071.%20DisplayManagerService%20%E2%80%94%20Reading%20connected%20DLNA%20device)                                                                                                                                                                                                                   | $810   |\n| 72  | DisplayManagerService       | [Faking Wi-Fi display settings](072.%20DisplayManagerService%20%E2%80%94%20Faking%20Wi-Fi%20display%20settings)                                                                                                                                                                                                                   | $1000  |\n| 73  | SurfaceFlinger              | [Changing device HFR mode](073.%20SurfaceFlinger%20%E2%80%94%20Changing%20device%20HFR%20mode)                                                                                                                                                                                                                                    | $200   |\n| 74  | Framework                   | [Call state leakage](074.%20Framework%20%E2%80%94%20Call%20state%20leakage)                                                                                                                                                                                                                                                       | $250   |\n| 75  | Framework                   | [Phone number disclosure without `READ_CALL_LOG` permission](075.%20Framework%20%E2%80%94%20Phone%20number%20disclosure%20without%20READ_CALL_LOG%20permission)                                                                                                                                                                   | $970   |\n| 76  | Framework                   | [Disclosure of telephony data in `DcTracker`](076.%20Framework%20%E2%80%94%20Disclosure%20of%20telephony%20data%20in%20DcTracker)                                                                                                                                                                                                 | $330   |\n| 77  | Framework                   | [Disclosure of KDDI CPA config updates](077.%20Framework%20%E2%80%94%20Disclosure%20of%20KDDI%20CPA%20config%20updates)                                                                                                                                                                                                           | $200   |\n| 78  | Framework                   | [Enabling and disabling Wi-Fi MHS D2D advertise](078.%20Framework%20%E2%80%94%20Enabling%20and%20disabling%20Wi-Fi%20MHS%20D2D%20advertise)                                                                                                                                                                                       | $250   |\n| 79  | Settings                    | [Auto enabling Bluetooth via `CheckBluetoothStateActivity`](079.%20Settings%20%E2%80%94%20Auto%20enabling%20Bluetooth%20via%20CheckBluetoothStateActivity)                                                                                                                                                                        | $200   |\n| 80  | Settings                    | [Setting auto power-up time](080.%20Settings%20%E2%80%94%20Setting%20auto%20power-up%20time)                                                                                                                                                                                                                                      | $290   |\n| 81  | Settings                    | [Changing device density](081.%20Settings%20%E2%80%94%20Changing%20device%20density)                                                                                                                                                                                                                                              | $250   |\n| 82  | Settings                    | [Logging NAI value](082.%20Settings%20%E2%80%94%20Logging%20NAI%20value)                                                                                                                                                                                                                                                          | $200   |\n| 83  | Phone calls                 | [Autoswitching between `-10000` and `0` users](083.%20Phone%20calls%20%E2%80%94%20Autoswitching%20between%20-10000%20and%200%20users)                                                                                                                                                                                             | $200   |\n| 84  | Phone calls                 | [Leakage of Wi-Fi made calls](084.%20Phone%20calls%20%E2%80%94%20Leakage%20of%20Wi-Fi%20made%20calls)                                                                                                                                                                                                                             | $210   |\n| 85  | Phone                       | [Leakage of voicemail phone numbers](085.%20Phone%20%E2%80%94%20Leakage%20of%20voicemail%20phone%20numbers)                                                                                                                                                                                                                       | $300   |\n| 86  | NFC                         | [Enabling and disabling NFC](086.%20NFC%20%E2%80%94%20Enabling%20and%20disabling%20NFC)                                                                                                                                                                                                                                           | $200   |\n| 87  | Phone and Messaging Storage | [Korea - Write access to SMS](087.%20Phone%20and%20Messaging%20Storage%20%E2%80%94%20Korea%20-%20Write%20access%20to%20SMS)                                                                                                                                                                                                       | $200   |\n| 88  | Phone and Messaging Storage | [Logging SIM card messages](088.%20Phone%20and%20Messaging%20Storage%20%E2%80%94%20Logging%20SIM%20card%20messages)                                                                                                                                                                                                               | $200   |\n| 89  | Gear S PlugIn               | [XSS injection](089.%20Gear%20S%20PlugIn%20%E2%80%94%20XSS%20injection)                                                                                                                                                                                                                                                           | $220   |\n| 90  | Device care                 | [Enabling and disabling power saving](090.%20Device%20care%20%E2%80%94%20Enabling%20and%20disabling%20power%20saving)                                                                                                                                                                                                             | $250   |\n| 91  | Device care                 | [Enabling and disabling auto restart](091.%20Device%20care%20%E2%80%94%20Enabling%20and%20disabling%20auto%20restart)                                                                                                                                                                                                             | $250   |\n| 92  | Device care                 | [Autocleaning memory](092.%20Device%20care%20%E2%80%94%20Autocleaning%20memory)                                                                                                                                                                                                                                                   | $250   |\n| 93  | Device care                 | [Leakage of unused apps](093.%20Device%20care%20%E2%80%94%20Leakage%20of%20unused%20apps)                                                                                                                                                                                                                                         | $250   |\n| 94  | Device care                 | [Changing CPU and enhanced processing values](094.%20Device%20care%20%E2%80%94%20Changing%20CPU%20and%20enhanced%20processing%20values)                                                                                                                                                                                           | $250   |\n| 95  | Calendar                    | [Leakage of calendar events, reminders, attendees](095.%20Calendar%20%E2%80%94%20Leakage%20of%20calendar%20events%2C%20reminders%2C%20attendees)                                                                                                                                                                                  | $1990  |\n| 96  | Good Lock                   | [Intent redirection](096.%20Good%20Lock%20%E2%80%94%20Intent%20redirection)                                                                                                                                                                                                                                                       | $700   |\n| 97  | KnoxCustomManagerService    | [Reading EDM values via System UI callbacks](097.%20KnoxCustomManagerService%20%E2%80%94%20Reading%20EDM%20values%20via%20System%20UI%20callbacks)                                                                                                                                                                                | $1180  |\n| 98  | NetworkManagementService    | [Limiting network speed and prioritizing custom apps](098.%20NetworkManagementService%20%E2%80%94%20Limiting%20network%20speed%20and%20prioritizing%20custom%20apps)                                                                                                                                                              | $250   |\n| 99  | WifiServiceImpl             | [Adding custom DNS servers](099.%20WifiServiceImpl%20%E2%80%94%20Adding%20custom%20DNS%20servers)                                                                                                                                                                                                                                 | $2250  |\n| 100 | Framework                   | [Wiping the device when the user erases the SD card via MDM](100.%20Framework%20%E2%80%94%20Wiping%20the%20device%20when%20the%20user%20erases%20the%20SD%20card%20via%20MDM)                                                                                                                                                     | $590   |\n| 101 | Framework                   | [Disabling device multisound](101.%20Framework%20%E2%80%94%20Disabling%20device%20multisound)                                                                                                                                                                                                                                     | $250   |\n| 102 | Framework                   | [Changing device input method](102.%20Framework%20%E2%80%94%20Changing%20device%20input%20method)                                                                                                                                                                                                                                 | $250   |\n| 103 | Framework                   | [Changing network code, carrier id, and operator brand](103.%20Framework%20%E2%80%94%20Changing%20network%20code%2C%20carrier%20id%2C%20and%20operator%20brand)                                                                                                                                                                   | $350   |\n| 104 | Framework                   | [Disconnecting Wi-Fi display](104.%20Framework%20%E2%80%94%20Disconnecting%20Wi-Fi%20display)                                                                                                                                                                                                                                     | $980   |\n| 105 | Framework                   | [Changing game mode and scan rate](105.%20Framework%20%E2%80%94%20Changing%20game%20mode%20and%20scan%20rate)                                                                                                                                                                                                                     | $330   |\n| 106 | Framework                   | [Leakage of Wi-Fi AP password to logs](106.%20Framework%20%E2%80%94%20Leakage%20of%20Wi-Fi%20AP%20password%20to%20logs)                                                                                                                                                                                                           | $200   |\n| 107 | Bluetooth                   | [Disabling Wi-Fi P2P](107.%20Bluetooth%20%E2%80%94%20Disabling%20Wi-Fi%20P2P)                                                                                                                                                                                                                                                     | $250   |\n| 108 | Settings                    | [Enabling Bluetooth via `DevicePickerActivity`](108.%20Settings%20%E2%80%94%20Enabling%20Bluetooth%20via%20DevicePickerActivity)                                                                                                                                                                                                  | $200   |\n| 109 | Settings                    | [Cleaning app cache list because of a typo in action](109.%20Settings%20%E2%80%94%20Cleaning%20app%20cache%20list%20because%20of%20a%20typo%20in%20action)                                                                                                                                                                        | $250   |\n| 110 | Settings                    | [Logging SIM serial number](110.%20Settings%20%E2%80%94%20Logging%20SIM%20serial%20number)                                                                                                                                                                                                                                        | $460   |\n| 111 | Phone calls                 | [Korea - Leakage of call info when using filtering](111.%20Phone%20calls%20%E2%80%94%20Korea%20-%20Leakage%20of%20call%20info%20when%20using%20filtering)                                                                                                                                                                         | $370   |\n| 112 | Phone                       | [Logging SIM serial number](112.%20Phone%20%E2%80%94%20Logging%20SIM%20serial%20number)                                                                                                                                                                                                                                           | $300   |\n| 113 | NFC                         | [Hardcoded AES key to encrypt card emulation PINs](113.%20NFC%20%E2%80%94%20Hardcoded%20AES%20key%20to%20encrypt%20card%20emulation%20PINs)                                                                                                                                                                                       | $660   |\n| 114 | NFC                         | [Korea and China - Enabling NDEF pushes and reader](114.%20NFC%20%E2%80%94%20Korea%20and%20China%20-%20Enabling%20NDEF%20pushes%20and%20reader)                                                                                                                                                                                   | $450   |\n| 115 | Call settings               | [Reset DSA SIM states](115.%20Call%20settings%20%E2%80%94%20Reset%20DSA%20SIM%20states)                                                                                                                                                                                                                                           | $730   |\n| 116 | Call settings               | [Autoswitching to eSIM](116.%20Call%20settings%20%E2%80%94%20Autoswitching%20to%20eSIM)                                                                                                                                                                                                                                           | $250   |\n| 117 | Call settings               | [Leakage of telephony data](117.%20Call%20settings%20%E2%80%94%20Leakage%20of%20telephony%20data)                                                                                                                                                                                                                                 | $370   |\n| 118 | Epdg                        | [Verizon - Enabling and disabling Wi-Fi calls](118.%20Epdg%20%E2%80%94%20Verizon%20-%20Enabling%20and%20disabling%20Wi-Fi%20calls)                                                                                                                                                                                                | $270   |\n| 119 | Epdg                        | [Leakage of telephony data](119.%20Epdg%20%E2%80%94%20Leakage%20of%20telephony%20data)                                                                                                                                                                                                                                            | $970   |\n| 120 | Epdg                        | [Logging location, PLMN values](120.%20Epdg%20%E2%80%94%20Logging%20location%2C%20PLMN%20values)                                                                                                                                                                                                                                  | $200   |\n| 121 | Accessibility               | [Enabling automute of all sounds](121.%20Accessibility%20%E2%80%94%20Enabling%20automute%20of%20all%20sounds)                                                                                                                                                                                                                     | $250   |\n| 122 | Daily Board                 | [Disclosure of user location](122.%20Daily%20Board%20%E2%80%94%20Disclosure%20of%20user%20location)                                                                                                                                                                                                                               | $250   |\n| 123 | Samsung Flow                | [Disclosure of mirrored data](123.%20Samsung%20Flow%20%E2%80%94%20Disclosure%20of%20mirrored%20data)                                                                                                                                                                                                                              | $450   |\n| 124 | Contacts                    | [Disclosure of group info](124.%20Contacts%20%E2%80%94%20Disclosure%20of%20group%20info)                                                                                                                                                                                                                                          | $630   |\n| 125 | Phone                       | [Disclosure of missed calls data](125.%20Phone%20%E2%80%94%20Disclosure%20of%20missed%20calls%20data)                                                                                                                                                                                                                             | $1045  |\n| 126 | My Files                    | [Theft and overwrite of arbitrary files](126.%20My%20Files%20%E2%80%94%20Theft%20and%20overwrite%20of%20arbitrary%20files)                                                                                                                                                                                                        | $1050  |\n| 127 | My Files                    | [Theft of arbitrary files](127.%20My%20Files%20%E2%80%94%20Theft%20of%20arbitrary%20files)                                                                                                                                                                                                                                        | $1180  |\n| 128 | InputMethodManagerService   | [Preventing the device from being locked](128.%20InputMethodManagerService%20%E2%80%94%20Preventing%20the%20device%20from%20being%20locked)                                                                                                                                                                                       | $230   |\n| 129 | Settings                    | [Logging APN settings](129.%20Settings%20%E2%80%94%20Logging%20APN%20settings)                                                                                                                                                                                                                                                    | $200   |\n| 130 | Framework                   | [Adding arbitrary apps to the `netd` speed whitelist](130.%20Framework%20%E2%80%94%20Adding%20arbitrary%20apps%20to%20the%20netd%20speed%20whitelist)                                                                                                                                                                             | $250   |\n| 131 | NFC                         | [Leakage of card emulation passwords](131.%20NFC%20%E2%80%94%20Leakage%20of%20card%20emulation%20passwords)                                                                                                                                                                                                                       | $200   |\n| 132 | Call                        | [Leakage of called phone numbers](132.%20Call%20%E2%80%94%20Leakage%20of%20called%20phone%20numbers)                                                                                                                                                                                                                              | $640   |\n| 133 | EmergencyManagerService     | [Enabling emergency mode](133.%20EmergencyManagerService%20%E2%80%94%20Enabling%20emergency%20mode)                                                                                                                                                                                                                               | $250   |\n| 134 | CSC                         | [Leakage of telephony data](134.%20CSC%20%E2%80%94%20Leakage%20of%20telephony%20data)                                                                                                                                                                                                                                             | $450   |\n| 135 | Weather                     | [Hardcoded AES key for encrypted logs containing sensitive data](135.%20Weather%20%E2%80%94%20Hardcoded%20AES%20key%20for%20encrypted%20logs%20containing%20sensitive%20data)                                                                                                                                                     | $250   |\n| 136 | My Files                    | [Disclosure of a Google Drive login intent](136.%20My%20Files%20%E2%80%94%20Disclosure%20of%20a%20Google%20Drive%20login%20intent)                                                                                                                                                                                                | $330   |\n| 137 | Call                        | [Disclosure of phone numbers and phone data](137.%20Call%20%E2%80%94%20Disclosure%20of%20phone%20numbers%20and%20phone%20data)                                                                                                                                                                                                    | $1050  |\n| 138 | MmsService                  | [Logging IMSI value](138.%20MmsService%20%E2%80%94%20Logging%20IMSI%20value)                                                                                                                                                                                                                                                      | $460   |\n| 139 | My Files                    | [Disclosure of paths of user-interacted files](139.%20My%20Files%20%E2%80%94%20Disclosure%20of%20paths%20of%20user-interacted%20files)                                                                                                                                                                                            | $400   |\n| 140 | Bluetooth                   | [Disclosure of connected Bluetooth devices](140.%20Bluetooth%20%E2%80%94%20Disclosure%20of%20connected%20Bluetooth%20devices)                                                                                                                                                                                                     | $640   |\n| 141 | ThemeManager                | Arbitrary file overwrite with system privilege        |        |\n| 142 | CcInfo                      | Log dump and exposure                                 |        |\n| 143 | Framework                   | WAP push leakage                                      |        |\n| 144 | NotificationManagerService  | Muting wearables                                      |        |\n| 145 | iaft                        | Arbitrary code execution with system privilege        |        |\n| 146 | AudioService                | Sending broadcasts with arbitrary actions             |        |\n| 147 | Settings Suggestions        | Intent redirection                                   |        |\n| 148 | Email                       | Data hemorrhage                                      |        |\n| 149 | Samsung Internet            | Secret mode reset                                    |        |\n| 150 | Modes and Routines          | Schedule exposure                                    |        |\n| 151 | Settings                    | Open notification panel                              |        |\n| 152 | Dual Messenger              | Intent redirection with system privilege              |        |\n| 153 | SVC Agent                   | IMEI exposure                                        |        |\n| 154 | Settings                    | Automatically enabling auto hotspot                   |        |\n| 155 | Camera                      | Exposure of images                                   |        |\n| 156 | Samsung Health              | Intent redirection to file access                     |        |\n| 157 | Epdg                        | Disabling Wi-Fi calls                                |        |\n| 158 | SmartThings                 | Remote views disclosure                              |        |\n| 159 | Settings                    | Connecting to arbitrary Wi-Fis                       |        |\n| 160 | Samsung Health Chart Library | Workout state leaks                                 |        |\n| 161 | Settings                    | Automatically enabling Wi-Fi                         |        |\n| 162 | Framework                   | Theft of arbitrary files with system privilege        |        |\n| 163 | Samsung Health              | PendingIntent hijacking                              |        |\n| 164 | Pass-sdk                    | Access token leakage                                 |        |\n| 165 | KAM                         | Misconfigured Firebase                               |        |\n| 166 | Contacts                    | Sensitive data exposure                              |        |\n| 167 | Samsung Health Chart Library | Workout state leaks                                 |        |\n| 168 | Samsung Flow                | Automatically enabling Bluetooth                      |        |\n| 169 | Email                       | Data hemorrhage                                      |        |\n| 170 | Email                       | Data hemorrhage                                      |        |\n| 171 | Galaxy Store                | Access token disclosure                              |        |\n| 172 | Framework                   | Multiple implicit broadcasts                         |        |\n| 173 | Samsung Keyboard            | Theft of arbitrary files with system privilege        |        |\n| 174 | Framework                   | Access to content providers (LmsAssemblyTrackerCTC)   |        |\n| 175 | Framework                   | Access to content providers (WifiGeofenceManager)     |        |\n| 176 | Framework                   | Access to content providers (SemWifiApTimeOutImpl)    |        |\n\n## Conclusion\n\nMobile app security is more critical than ever in today's digital landscape. As we have shown through our research, even the most reputable brands are not immune to the threat of cyberattacks. \n\nAt Oversecured, we are committed to help our clients stay ahead of the curve with our industry-leading mobile app vulnerability scanning technology. With our comprehensive approach to mobile app security, you can trust that your brand and your users are protected from data breaches and other security threats.\n\nDon't wait until it's too late. [Get a free consultation](https:\u002F\u002Foversecured.com\u002F) and find out how we can help secure your mobile apps. Together, we can build a safer digital world.\n","该项目汇总了Oversecured公司在2022–2025年间与三星合作发现并推动修复的176个预装Android应用安全漏洞，涵盖权限绕过、组件暴露、敏感数据泄露等典型移动安全问题。基于其自研移动应用静态与动态分析技术，项目突出对厂商定制系统应用（如One UI预装服务）的深度漏洞挖掘能力，并附有部分漏洞的详细技术分析与修复验证记录。适用于移动安全研究、厂商供应链安全审计、Android系统级漏洞分析及漏洞披露实践参考场景。",2,"2026-07-17 02:30:06","CREATED_QUERY"]