Samsung Mobile Security

1. Thank you for your continued contributions to the security of Samsung Mobile products and services. Your reports help us identify and remediate high-impact vulnerabilities before they can affect our users, and we remain committed to rewarding high-quality research fairly and promptly.
2. As automated, unverified AI-generated reports have become widespread, the overall volume of reports to our program has increased significantly. To keep report analysis and remediation timely, and to ensure that solid, high-quality reports are reviewed and rewarded without delay, we are updating the following program policies, effective September 9, 2026 (KST). Reports submitted before the effective date will be handled under the previous policy.
3. The primary purpose of this change is to clarify our expectations for report quality, ensuring that we can focus our resources on the high-impact vulnerabilities. We continue to welcome vulnerability research, and this update does not narrow the scope of the program. Eligible reports will continue to be rewarded fairly.

1. Every submission must include a working Proof-of-Concept (PoC) that demonstrates a concrete security impact.
2. • Reports based only on static code review, without a working PoC, will be determined as Not Eligible.
   • A report that only demonstrates a crash is not eligible for a reward and may be forwarded to the development team for a stability review. However, if the report provides verifiable evidence that the crash leads to a practical security impact — such as control of the program counter or execution flow, controlled memory corruption, a denial of service that qualifies under the Severity Classification, or another clearly demonstrated security impact recognized under the program's reward criteria — it will be assessed as eligible.
   • A crash must be reachable in a practical attack path. Crashes produced by artificially bypassing the product's legitimate attack surface — for example, directly loading a native library via dlopen and calling its internal APIs with malformed input, without going through the input validation performed by the calling layers in the actual product — are not considered a valid security impact. Such reports will be determined as Not Eligible unless concrete evidence is provided that the same input can reach the affected code through a legitimate attack path.
   • Severity and reward amounts are determined based on the impact demonstrated by the provided PoC. Claims or assumptions of a higher potential impact – for example, asserting that remote code execution is achievable – are generally not considered valid impact unless supported by a working demonstration.

1. To speed up validation and reproduction, every submission must include a completed template file describing the vulnerability, test environment, and reproduction steps.
2. ※ For details on the submission template, please refer to the Standard Submission Template Guide.
3. Submission of the template is a mandatory requirement for all reports. Because a completed template helps us validate and reproduce a report more quickly, submitting a complete template can lead to faster patching and rewards. Unlike the PoC requirement, a missing or incomplete template does not automatically make a valid report Not Eligible.
4. • The template consists of required fields and recommended fields. Templates are assessed as follows:
     • Fully complete: All required and recommended fields are completed accurately.
     • Partially complete: All required fields are completed accurately, but some recommended fields are missing. Leaving recommended fields blank does not by itself make a template incomplete.
     • Incomplete: One or more required fields are not completed, or no template is submitted.
   • The Good Report Bonus is paid on a tiered basis according to the completeness of the template: A fully complete template receives the full Good Report Bonus, and a partially complete template receives a partial Good Report Bonus. Reports with an incomplete template are not eligible for the Good Report Bonus.
   • An incomplete or missing template does not by itself result in a report being determined as Not Eligible – if the practical security impact is sufficiently demonstrated by PoC, remediation and reward assessment will still proceed. However, in such cases the base reward is substantially reduced.
5. ※ Details on how these requirements relate to the Good Report Bonus and ISVP rewards are covered in a separate Reward Policy Update.

1. We welcome the responsible use of AI-assisted research tools. Regardless of the tools used, researchers remain responsible for independently validating each submitted finding and confirming its reproducibility and practical security impact.
2. • Reports that share the same root cause and impact as an existing report are closed under our existing duplicate-report policy.
   • Reports that repeatedly lack validation, reproduction steps, or evidence of security impact may be deprioritized in our review queue, and submissions may be restricted.

Monthly Submission Limits

1. To ensure timely review and remediation for all researchers, monthly submission quotas are dynamically assigned based on each researcher's submission history and report quality.
2. • Monthly Quotas: Quotas are refreshed on a monthly basis.
   • Slot Availability: As active submissions are resolved, additional submission capacity becomes available.
   • Individual Basis: Quotas apply per individual researcher rather than per account. Bypassing limits through multiple accounts is not permitted and may result in quota restrictions.
   • Exemptions: Researchers with a consistent record of high-quality, high-impact, and well-verified reports may receive higher quotas or exemptions.

1. Please check the following notices on our official website.
2. • Standard Submission Template Guide
   • Reward Policy Update

1. With deep respect and gratitude for the researchers' support, our rewards program will continue to operate so that high-impact research is rewarded fairly and quickly. This change is intended to allow us to spend our time where it matters most: on your most important findings.
2. For any questions, please contact us, Samsung Mobile Security (mobile.security@samsung.com).

1. We continuously review our reward policies to ensure that important vulnerabilities discovered through researchers' valuable work are rewarded fairly and transparently. In line with the Program Policy Update announced together with this notice, we are sharing the reward policy update below.

1. Starting September 9, 2026 (KST), a working PoC is a mandatory requirement for every report, and reports without a working PoC are excluded from rewards under the Samsung Mobile Security Rewards Program. For example, a report based only on static code review, without a working PoC, will be determined as Not Eligible. In addition, a report whose PoC only demonstrates that a crash occurs is not eligible for a reward and may be forwarded to the development team for a stability review. However, if evidence is provided that the crash leads to one of the following practical security impacts, the report may be assessed for a reward:
2. • Control of the program counter or execution flow
   • Controlled memory corruption
   • A denial of service that qualifies under the Severity Classification
   • Another clearly demonstrated security impact recognized under the Severity Classification
3. Furthermore, the demonstrated impact must be reachable through a practical attack path. Crashes produced by artificially bypassing the product's legitimate attack surface — such as directly invoking internal library APIs via dlopen with malformed input — are not considered a valid security impact.

1. Mandatory Standard Submission Template
2. Starting September 9, 2026 (KST), every report must include the standard submission template with the required fields completed. The template captures the essential information about the report, including the reproduction steps, and submission of the template is a mandatory requirement for all reports.
3. The template consists of required fields and recommended fields, and templates are assessed as follows:
4. • Fully complete: All required and recommended fields are completed accurately.
   • Partially complete: All required fields are completed accurately, but some recommended fields are missing. Leaving recommended fields blank does not by itself make a template incomplete.
   • Incomplete: One or more required fields are not completed, or no template is submitted.
5. Unlike the PoC eligibility requirement, an incomplete or missing template does not by itself result in a report being determined as Not Eligible – if the practical security impact is sufficiently demonstrated, remediation and reward assessment will still proceed. In such cases, the base reward is substantially reduced, and the report is not eligible for the Good Report Bonus.
6. ※ For details on template submission, please refer to the Standard Submission Template Guide.

1. We continue to pay an additional reward for well-written reports through the Good Report Bonus. The Good Report Bonus applies only to vulnerabilities in Android mobile devices (smartphones and tablets). Vulnerabilities in other products, such as wearables, and server-side, web service, or backend vulnerabilities are not eligible for the Good Report Bonus and are assessed for a base reward under the existing policy.
2. For vulnerabilities with a final severity of High or Critical, a fully complete template receives the full Good Report Bonus, providing a total reward of up to twice the base reward, and a partially complete template receives a partial Good Report Bonus. For vulnerabilities rated Moderate, a partial Good Report Bonus is paid only when the template is fully complete. Reports rated Low or reports with an incomplete template are not eligible for the Good Report Bonus and are assessed for a base reward under the existing criteria.

Requirements for the Full Good Report Bonus

1. A report may receive the full Good Report Bonus when it satisfies all of the following:
2. • A valid and reward-eligible Android mobile device (smartphone or tablet) vulnerability
   • A final severity rated High or Critical
   • A working PoC that demonstrates a practical security impact
   • A fully complete template, in which both the required and recommended fields are completed accurately for the reported vulnerability

Recommended Items

1. Completing the required fields alone is sufficient to submit a report. However, to receive the full Good Report Bonus, the recommended items must also be accurately included in the template and submitted materials. This information helps us analyze the vulnerability and develop a patch quickly.

1. ISVP is a special reward program with the strictest requirements, and its reward is paid only to reports that satisfy all of its requirements. A report that fails to satisfy any one of these requirements — including a working PoC, Exploit and fully complete template — is not eligible for the ISVP reward. In that case, the report itself remains valid, and its base reward and Good Report Bonus are assessed under the same criteria as any other report. The existing ISVP reward structure and reward amounts remain unchanged.
2. If you are claiming an ISVP reward, the ISVP section of the template must be completed. It records the Important Scenario and target being claimed, the attack vector, whether the exploit executes without privileges, whether it was verified on the latest security update of the latest flagship devices, and the buildable exploit provided.

1. Report type	Treatment
   High or Critical Android mobile device vulnerability with a working PoC and a fully complete template	Base reward assessment; full Good Report Bonus
   High or Critical Android mobile device vulnerability with a working PoC and a partially complete template	Base reward assessment; partial Good Report Bonus
   Android mobile device vulnerability rated Moderate with a working PoC and a fully complete template	Base reward assessment; partial Good Report Bonus (no Good Report Bonus for partially complete or incomplete template)
   Android mobile device vulnerability rated Low	Base reward assessment; no Good Report Bonus
   Server-side, backend or other product (e.g., wearable) vulnerability	Base reward assessment; no Good Report Bonus
   Working PoC and demonstrated security impact, but template missing or incomplete	Base reward substantially reduced; no Good Report Bonus
   Crash only, without a demonstrated practical security impact	Not Eligible
   Static code review only, without a working PoC	Not Eligible
   Fully satisfied ISVP requirements (demonstrating the described scenario + Exploit + fully complete template)	ISVP reward
   Any one of the ISVP requirements (demonstrating the described scenario + Exploit + fully complete template) not satisfied	No ISVP reward; base reward and Good Report Bonus assessed under the standard criteria

1. This reward policy update supplements the existing Good Report Bonus policy; where the two conflict, this update takes precedence.
2. We appreciate your continued interest and participation in the Samsung Mobile Security Rewards Program.

1. We are introducing a standardized submission template for reporting vulnerabilities to the Samsung Mobile Security Rewards Program. Effective September 9, 2026 (KST), every report must include a working Proof-of-Concept (PoC) and a completed template. Please refer to the following details.
2. • Template Name: submission_template_v10.yaml
   • Effective date: September 9, 2026 (KST)
   • Applies to: all submissions to the Samsung Mobile Security Rewards Program
   • Download: Submission Template

1. A completed template allows us to validate and reproduce your report faster, which means a faster review and a faster reward for solid research. Including a working PoC and completing every template field — both required and recommended — is a prerequisite for receiving the full Good Report Bonus.

1. • Fully complete the template and attach it to your report, zipped together with your PoC artifacts.
   • Required fields must be filled in.
   • Providing the recommended items helps enable faster patching, faster reward payment, and eligibility for the full Good Report Bonus.
   • If you are claiming an ISVP (Important Scenario Vulnerability Program) reward, complete the ISVP section of the template to declare the scenario and confirm that the ISVP requirements are met. If you are not claiming ISVP, leave claimed: false.

1. Do not submit the example values included in the template as-is.
2. • Delete any unused reproduction-step types and example entries.
   • List only files that are actually included with the submission under artifacts.
   • Replace every required example value with information specific to the reported vulnerability.
   • Optional fields may be left blank when they do not apply.

1. • A working PoC becomes mandatory. Reports based only on static code review, or that demonstrate only a crash without a practical security impact, will be determined as Not Eligible.
   • Submitting the template becomes mandatory. A report submitted without the template, or with an incomplete template, may have its base reward substantially reduced and is not eligible for the Good Report Bonus.
   • Reports submitted before the effective date will be handled under the previous policy.

1. For the full policy, please refer to the Program Policy Update and the Reward Policy Update.
2. For any questions, please contact Samsung Mobile Security (mobile.security@samsung.com).

1. We are pleased to present the third annual report of the Samsung Mobile Security Rewards Program, highlighting key security research contributions and vulnerability migration efforts in 2025.
2. In 2025, we successfully identified and remediated numerous vulnerabilities thanks to valuable submissions from the global security research community.
3. We sincerely appreciate the continued collaboration and dedication of security researchers worldwide.

1. 
2. In 2025, Samsung awarded a total of $879,770 to security researchers for valid vulnerability reports.
3. • We congratulate Vincenzo Bonforte for receiving the highest reward and securing the top position in the Hall of Fame.
   • We appreciate Dawuge, who has continuously collaborated with us and has been recognized as a Top 10 Hall of Fame researcher for five consecutive years.
   • Please check the 2025 Hall of Fame published today

1. While we celebrated first 1 million awards in 2024, the total rewards paid in 2025 amounted to about 880,000, representing a modest decline compared to 2024. We examined the trends over the past four years.
2. • Valid reports averaged around 550 annually in 2022 and 2023, but dropped to 450 in 2024 and 2025.
   • However, total rewards increased from $850,000(2022 and 2023) to $940,000(2024 and 2025), with the average reward per report rising from 1,500 to over 2,000 (an increase over 30%).

1. This positive trend aligns with our program's goal of "Ensuring customer safety through the discovery and proactive patching of high-impact vulnerabilities."
2. However, the challenge remains to uncover more high-impact vulnerabilities in important scenarios.
3. 

1. In August 2024, we launched the ISVP (Important Scenario Vulnerability Program) to strengthen the identification of crucial high-impact vulnerabilities.
2. The eligibility requirements for ISVP are extensive, resulting in no eligible reports until now. However, in March 2026, the first valid ISVP report was successfully remediated.
3. Details of this ISVP Case and an update including clearer policies and targets for the ISVP can be found in the "ISVP Milestone & Update" published today.
4. We look forward to greater participation and contributions to proactively address more high-impact vulnerabilities in advance through the activated ISVP.
5. ※ Since this annual report is based on vulnerabilities compensated in 2025, the first ISVP-related vulnerability will be included in next year's report.

1. In 2025, reports based on real-world exploits were notable. With great assistance from Meta Security, we became aware that vulnerabilities in the specific media library used in our devices were being used exploited. We were able to update the severity of 1-day vulnerability, and address the 0-day vulnerability immediately.
2. Additionally, Google Project Zero and Threat Analysis Group also reported further vulnerabilities in the same component, so we could address them immediately to effectively prevent potential exploits.
3. We sincerely appreciate Meta, Google, and the security communities for their assistance and collaboration.

1. We are continuously working to improve program operations based on various feedback. We applied updates including the addition of a Security Update History section for greater transparency, and modifying the Eligible Target posting format to reduce confusion and enhance visibility. We are also reviewing measures to reduce the time required to complete the entire rewards process and minimize the communication delays.
2. We would like to share that various discussions are ongoing regarding additional feedback that could further strengthen our program, and some updates require additional time to complete the discussions. We kindly ask your patience for a little longer!
4. Through this program, we continue to strengthen the security of hundreds of millions of Samsung Galaxy devices used worldwide, helping protect our users from real-world threats. We strongly believe that responsible disclosure and close collaboration with the security research community are essential to protecting users and strengthening the broader mobile security ecosystem.

1. Moving forward, we remain committed to strengthening the security of Samsung products and services through continued collaboration with the global security community.
2. Additionally, I would like to express my gratitude to my team, Samsung Project Infinity, for the dedication and efforts in all aspects of rewards program operations, including vulnerability analysis and response.
4. 감사합니다!
5. 

1. We sincerely appreciate your continued interest and participation since the launch of the Important Scenario Vulnerability Program (ISVP) in August 2024. We are pleased to share key milestones as well as important policy updates regarding the ISVP.

1. We launched the ISVP to enhance the identification of high-impact vulnerabilities. However, due to the extensive eligibility requirements for ISVP, there had been no eligible reports until now.
2. Yichen Chai and Sacha Kozma from BugScale submitted successful exploits for vulnerabilities within SmartSwitch and Galaxy Store, which align closely with the objectives of operating the ISVP, and the vulnerabilities were successfully remediated in March 2026. We would like to take this opportunity to recognize the the first successful ISVP submission.
3. They successfully submitted reports demonstrating remote and local arbitrary installation, corresponding to the “Arbitrary Application Install” category of the ISVP. Thanks to their active collaboration in contributing to the patch process, all vulnerabilities have been resolved through the March Applications Update, and a total reward of $150,000 is currently being processed in accordance with the ISVP policy.
4. We appreciate BugScale’s great assistance and their participation in this exciting journey, and we look forward to more interest and participation from you to make ISVP activated.

1. We have received requests from many researchers for clearer explanations of the eligibility scope, as well as consideration of expanding the program scope. We have carefully reviewed this feedback and completed our internal review. We are now updating the ISVP policy as follows.

1. One of the major concerns was that for some targets, it is difficult to specify the eligible scope of ISVP before submitting the report. Researchers invested significant effort in researching Galaxy devices and submitted eligible exploits to ISVP, but in cases where the issue is found to originated from the code developed by the chipset vendors, the reports are determined as ineligible for ISVP. Many researchers have expressed that this approach may be unfair and requires improvement.
2. It is difficult to include reports as eligible targets for our Rewards program, for vulnerabilities stemming from other companies’ implementation. Therefore, for both the Samsung Mobile Security Rewards Program and the Important Scenario Vulnerability Program, only vulnerabilities arising from Samsung Mobile’s implementation are considered eligible reports, while vulnerabilities related to other companies are determined ineligible.
3. After careful review, we have decided to expand the eligible scope of the ISVP program in line with its special purpose of proactively receiving and resolving important vulnerabilities. For the “Arbitrary code execution” category targeting Rich OS, we are expanding the scope to include ISVP reports that involve vulnerabilities stemming from other vendors’ implementation as eligible for partial rewards.
4. Here is the updated policy for eligible scope and rewards of Rich OS ACE.
5. • Exploits utilizing vulnerabilities found in Samsung Mobile code: Eligible (Full Reward)
   • Exploits combining vulnerabilities in Samsung Mobile code and other vendor code: Eligible (Partial Reward)
   • Exploits consisting solely of vulnerabilities in other vendor code without Samsung Mobile vulnerability: Not eligible (No Reward)
     • In cases where the exploit is consisted solely of vulnerabilities in Samsung DS: Eligible (Partial Reward)

1. Based on extensive analysis of reported vulnerabilities and ongoing security improvements, the targets and rewards for each category of ISVP have been updated.

1. The maximum reward amount for Arbitrary Code Execution in Rich OS has been adjusted.
2. • Local : $150,000 → $100,000
   • Remote : $300,000 → $200,000
   
      Note: As explained above, exploits that include vendor vulnerabilities for this category can be considered eligible reports for partial rewards.

1. The maximum reward amounts for the two categories have been adjusted as follows
2. • TEEGRIS OS - Remote ACE : $400,000 → $500,000
   • Device Unlock - Full User Data Extraction from BFU : $400,000 → $500,000

1. • The existing “Remote” category has been divided into “Adjacent” and “Remote”, while the “Local” category is removed.
   • Bonus reward are added for this category. If reports successfully demonstrate installation with obtaining System UID or granting dangerous or higher-level permissions, they will receive an extra bonus.

1. Due to the stable operation of the Auto Blocker, the relevant item has been decided to be removed from ISVP.

1. For more detailed information on the updates, please refer to the newly added ISVP page on our website.