Security Post
Announcement
Annual Report in 2025
Jasper Park, Head of Samsung Project Infinity at Samsung Mobile Security
16 Mar 2026
- We are pleased to present the third annual report of the Samsung Mobile Security Rewards Program, highlighting key security research contributions and vulnerability migration efforts in 2025.
- In 2025, we successfully identified and remediated numerous vulnerabilities thanks to valuable submissions from the global security research community.
- We sincerely appreciate the continued collaboration and dedication of security researchers worldwide.
Review of 2025
- In 2025, Samsung awarded a total of $879,770 to security researchers for valid vulnerability reports.
-
- We congratulate Vincenzo Bonforte for receiving the highest reward and securing the top position in the Hall of Fame.
- We appreciate Dawuge, who has continuously collaborated with us and has been recognized as a Top 10 Hall of Fame researcher for five consecutive years.
- Please check the 2025 Hall of Fame published today
Trend Analysis
- While we celebrated first 1 million awards in 2024, the total rewards paid in 2025 amounted to about 880,000, representing a modest decline compared to 2024. We examined the trends over the past four years.
-
- Valid reports averaged around 550 annually in 2022 and 2023, but dropped to 450 in 2024 and 2025.
- However, total rewards increased from $850,000(2022 and 2023) to $940,000(2024 and 2025), with the average reward per report rising from 1,500 to over 2,000 (an increase over 30%).
- This positive trend aligns with our program's goal of "Ensuring customer safety through the discovery and proactive patching of high-impact vulnerabilities."
- However, the challenge remains to uncover more high-impact vulnerabilities in important scenarios.
"ISVP (Important Scenario Vulnerability Program)"
- In August 2024, we launched the ISVP (Important Scenario Vulnerability Program) to strengthen the identification of crucial high-impact vulnerabilities.
- The eligibility requirements for ISVP are extensive, resulting in no eligible reports until now. However, in March 2026, the first valid ISVP report was successfully remediated.
- Details of this ISVP Case and an update including clearer policies and targets for the ISVP can be found in the "ISVP Milestone & Update" published today.
- We look forward to greater participation and contributions to proactively address more high-impact vulnerabilities in advance through the activated ISVP.
- ※ Since this annual report is based on vulnerabilities compensated in 2025, the first ISVP-related vulnerability will be included in next year's report.
"Response to in-the-wild exploits"
- In 2025, reports based on real-world exploits were notable. With great assistance from Meta Security, we became aware that vulnerabilities in the specific media library used in our devices were being used exploited. We were able to update the severity of 1-day vulnerability, and address the 0-day vulnerability immediately.
- Additionally, Google Project Zero and Threat Analysis Group also reported further vulnerabilities in the same component, so we could address them immediately to effectively prevent potential exploits.
- We sincerely appreciate Meta, Google, and the security communities for their assistance and collaboration.
“Ongoing Program Improvements”
- We are continuously working to improve program operations based on various feedback. We applied updates including the addition of a Security Update History section for greater transparency, and modifying the Eligible Target posting format to reduce confusion and enhance visibility. We are also reviewing measures to reduce the time required to complete the entire rewards process and minimize the communication delays.
- We would like to share that various discussions are ongoing regarding additional feedback that could further strengthen our program, and some updates require additional time to complete the discussions. We kindly ask your patience for a little longer!
- Through this program, we continue to strengthen the security of hundreds of millions of Samsung Galaxy devices used worldwide, helping protect our users from real-world threats. We strongly believe that responsible disclosure and close collaboration with the security research community are essential to protecting users and strengthening the broader mobile security ecosystem.
- Moving forward, we remain committed to strengthening the security of Samsung products and services through continued collaboration with the global security community.
- Additionally, I would like to express my gratitude to my team, Samsung Project Infinity, for the dedication and efforts in all aspects of rewards program operations, including vulnerability analysis and response.
- 감사합니다!
