Introduction
An attacker with local access to a Samsung Galaxy device could gain SystemUI-level privileges through a flaw in the Routines automation feature. The flaw, tracked as CVE-2025-21058, shows the risk that comes with complex automation tools built into Android devices.
Samsung Routines is an automation system that ships widely on Galaxy smartphones and tablets. Users set up custom behaviors that run on triggers such as time, location, or device state. Routines is deeply integrated with system components and runs in a privileged execution context, so a vulnerability in it has an outsized impact on consumers and enterprises alike.
Technical information
CVE-2025-21058 is an improper access control vulnerability in the Samsung Routines application. It affects versions prior to 4.8.7.1 on Android 15 and prior to 4.9.6.0 on Android 16. Routines does not check authorization sufficiently, so a local attacker with access to the device can execute arbitrary code with SystemUI privileges. That privilege level gives broad control over system UI elements and access to sensitive resources that normal applications cannot reach.
The vulnerability triggers when Routines exposes privileged operations to local processes without properly validating the caller's identity or permissions. This breaks the intended security boundary between user applications and system-level components. The root cause is that the affected versions of Routines do not enforce access control strictly enough. As of the October 2025 disclosure, no public code snippets or detailed exploitation flows are available.
Routines version 4.8.7.1 (Android 15) and 4.9.6.0 (Android 16) fix the issue by adding proper access control checks.
Affected systems and versions
- Samsung Galaxy devices running Android 15 with Routines versions prior to 4.8.7.1
- Samsung Galaxy devices running Android 16 with Routines versions prior to 4.9.6.0
- All configurations where Samsung Routines is present and not updated to the fixed version
Vendor security history
Samsung has fixed similar privilege escalation and access control issues in its custom Android components before, including vulnerabilities in Galaxy Store and in image parsing libraries. Those were patched promptly after coordinated disclosure. Samsung runs a monthly security update program, and its patch response time has been consistent, especially for critical and high-severity vulnerabilities. The Samsung Knox platform adds further layers of security, and the company works with external researchers on an ongoing basis.
