The critical image-processing vulnerability allowed remote code execution on millions of Samsung phones running Android 13 to 16
A Critical Vulnerability in Samsung Devices
Samsung has patched a major zero-day security flaw that was being actively exploited to remotely hack its customers’ smartphones. The vulnerability existed in a software library responsible for displaying images, making it possible for attackers to plant malicious code on devices without user interaction.
- The flaw impacted Samsung phones running Android 13 through Android 16.
- It was privately disclosed to Samsung by Meta and WhatsApp on August 13.
- The exploit was already being used “in the wild” at the time of disclosure.
What Makes It a Zero-Day?
The term zero-day refers to a vulnerability that is actively exploited before a fix is made available. In this case, Samsung had no prior warning before the attacks were already underway.
- No list of affected devices has been released by Samsung.
- The company has issued a security patch, but details remain scarce.
- A spokesperson declined to comment ahead of the announcement.
The absence of device-specific information raises concerns, as many users may not know they’re vulnerable.
Coordinated Attacks and Broader Spyware Campaign
The Samsung patch follows similar security updates by Apple and WhatsApp in response to what appears to be a coordinated spyware campaign.
- WhatsApp disclosed that fewer than 200 users were targeted or compromised in the recent attacks.
- Apple described the vulnerability it patched as part of an “extremely sophisticated attack” aimed at high-risk individuals.
- On September 3, Apple notified additional victims, believed to be linked to the same campaign, according to French government officials.
While neither company has shared technical details, the timing suggests the Samsung zero-day may be linked to these broader campaigns.
The Attack Vector: Image Libraries
The exploit stems from a flaw in the image-handling code — a particularly dangerous area since image files are routinely received via messaging apps, emails, and websites.
- Attackers could deliver malicious images that trigger the vulnerability upon opening or preview.
- Since image processing often occurs in the background, users could be compromised without ever opening a file.
This makes it a high-impact vulnerability, especially for journalists, activists, or other high-risk individuals often targeted by spyware operations.
What Samsung Users Should Do
Although Samsung has not detailed the devices affected, users are advised to:
- Update their devices immediately to the latest security patch.
- Be cautious of unsolicited images or links, especially from unknown senders.
- Enable automatic updates where possible and use security-focused tools like app permission controls.
For high-risk users, using encrypted messaging apps, mobile threat detection tools, and staying informed through Apple or Meta’s alerts can also help mitigate risk.
Spyware Concerns Escalating Across Platforms
The fact that Apple, WhatsApp, and Samsung all issued patches within weeks of each other underscores the growing reach of commercial spyware.
- Tools like Pegasus have already demonstrated how zero-click attacks can infiltrate both Android and iOS.
- The campaign’s limited scale — targeting fewer than 200 users — suggests a focus on surveillance, not broad criminal activity.
- Security experts believe these attacks are likely backed by nation-states or private surveillance firms.
With little visibility into who is behind the attacks, companies and users alike remain on high alert.
