Press play to start listening
Researchers at mobile security firm Oversecured have published findings from a three-year audit of built-in Samsung phone apps, discovering 176 security vulnerabilities in preinstalled system applications.
According to research shared with Hackread.com, these apps are deeply integrated into the operating system and lack a standard uninstall option. This is why users cannot remove them without rooting their devices, leaving them exposed whenever security flaws are discovered in factory software.
Why Default System Apps Pose Higher Risks
Preinstalled system applications can receive elevated access to internal hardware and operating-system functions. While standard apps downloaded from app stores run inside strict safety boundaries (sandboxes), these preinstalled system apps can receive privileges unavailable to ordinary applications, while some affected Samsung components operated under UID 1000, the Android system identity.
Oversecured said Samsung represents about 20% to 25% of the global smartphone market and estimated that more than 100 million devices were exposed before the reported flaws were patched
Oversecured said the vulnerabilities could be combined into attack chains providing system-level access, camera control, DNS manipulation, and data theft without requiring an expensive Android zero-day exploit.
The team also found more than 20 similar security flaws in Xiaomi devices during earlier testing, indicating that manufacturer-added software can create repeating security weaknesses among phone brands.
Specific Vulnerabilities and Package Names Disclosed
The research highlighted several specific exploit paths and package names:
- Silent Camera Recording (com.sec.factory.camera): A flaw in FactoryCamera exposed an unprotected broadcast receiver, allowing unprivileged apps to trigger recording without requesting standard permissions.
- Account Token Theft (com.samsung.android.oneconnect): A deep link sent through email or SMS could load an attacker-controlled page inside SmartThings, where the
McsBridge.getAuthInfo()JavaScript interface exposed Samsung Account tokens. Oversecured said exploitation required one click.
- Unauthorised Screen Mirroring (com.sec.android.app.dexonpc): A malicious app on the same Wi-Fi network could call
startScan()andconnect(), causing the device screen to stream to an attacker-controlled computer without further interaction.
- Network Traffic Hijacking (WifiServiceImpl): Samsung framework modifications exposed semAddPublicDnsAddr(), allowing unprivileged apps to alter device-wide DNS configurations.
- Code Execution & File Writes: A malicious app could deliver a crafted JPEG that caused DualOutFocusViewer (
com.samsung.android.app.dofviewer) to copy and load an attacker-controlled native library from external storage when the victim opened the image. Meanwhile, ThemeManager (com.samsung.android.themecenter) suffered from path traversal, allowing arbitrary file writes with system privileges.
Researchers noted that common attack patterns included forgotten debug interfaces, unsafe inter-process communication (IPC), path traversal, and insecure WebView configurations.
Checking Your Device Safety
The research was conducted between 2022 and 2025, during which Oversecured submitted each finding through Samsung’s vulnerability disclosure program. Samsung patched all 176 vulnerabilities through regular security updates, awarded Oversecured more than $200,000 in bug bounties, and placed the company first in its Security Hall of Fame.
Oversecured said devices running current Samsung security updates are protected from the reported flaws. The company documented 140 findings with full technical descriptions and disclosed the remaining 36 through CVE identifiers on GitHub.
The disclosure shows how proprietary software added by device manufacturers can create a privileged attack surface requiring the same level of scrutiny as core Android code.
