Security researchers praise Samsung for handling reported vulnerabilities

The security firm Oversecured has uncovered a total of 176 vulnerabilities in apps pre-installed on Samsung smartphones between 2022 and 2025. Now they are highlighting the good cooperation with Samsung. The vulnerabilities were not only promptly fixed after being reported, but security researchers have also received a total of 163,475 US dollars in cash rewards for their work through Samsung’s bug bounty program so far.

As early as 2021, Oversecured discovered that several security vulnerabilities in pre-installed apps threatened Samsung smartphones . Some of the 17 vulnerabilities found at the time could have allowed attackers to install apps with admin rights on Samsung smartphones, among other things. The company has quickly fixed most of the problems, while others have been closed by Samsung as part of the monthly patch day.

Now, security researchers are listing 176 vulnerabilities in pre-installed Samsung apps on GitHub that they have reported over the past four years and which were also fixed immediately. Some vulnerabilities could have allowed attackers to access data such as photos, messages, contacts, or call logs, or to install unwanted apps with admin rights.

Oversecured highlights the success rate of its own scanner in discovering vulnerabilities, but also thanks Samsung’s security team. As part of the vulnerability disclosure program (VDP) and regular security audits, they have ensured that users of Samsung smartphones are protected from significant attacks and data theft.

So far, Oversecured has received rewards for 140 of the 176 reported vulnerabilities; only these are documented on GitHub. The highest reward of 13,770 US dollars was for the discovery of several cases in which attackers could send broadcasts with sensitive information. This could have exposed users’ activities and events. A reward of 10,310 US dollars was given for finding a vulnerability in a system-internal app for testing the smartphone camera, which could have damaged files with system rights.

Oversecured lists further interesting vulnerabilities in its own blog . The security company also points out that it topped Samsung’s ranking of security researchers in 2022. These are ranked annually based on the impact, number, and severity of reported vulnerabilities. In 2023, Oversecured was still ranked third, but has not appeared in the top 10 in the past two years.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.