# SVE-2020-18025: Unauthorised access to Samsung secure folder files

Samsung Secure Folder files exposed via content:// URIs in Samsung Browser even while locked, enumerable by JavaScript and exfiltratable via XHR.

- Payout: $3,750
- Severity: high
- Program: Samsung
- Credited: Rahul Kankrale
- Disclosed: 2020-10-07
- Write-up quality: 6/10
- Original: https://servicenger.com/blog/mobile/sve-2020-18025-unauthorised-access-to-samsung-secure-folder-files/
- Library page: https://bugbountylibrary.com/r/blog%3Aservicenger-com-blog-mobile-sve-2020-18025-unauthorised-access-to-samsung-secure-folder-files
- Tags: domain:browser domain:mobile impact:data-leak kind:bounty platform:blog sev:high tech:android technique:js-analysis technique:recon vuln:access-control vuln:info-disclosure

**Target:** Samsung Browser / Secure Folder multi-user storage content provider
**Root cause:** Secure Folder files stored under multi-user storage (user 150) are reachable via content://150@media/external/file/<n> URIs, and Samsung Browser resolves these URIs without enforcing the Secure Folder lock state.
**Steps:**
1. Run `adb shell pm list users` to confirm Secure Folder user id (e.g. `UserInfo{150:Secure Folder: }`).
2. Build HTML that iterates `content://150@media/external/file/<i>` as script src, using onload/onerror to enumerate valid file numbers.
3. Deliver the HTML to victim via WhatsApp and open it in Samsung Browser.
4. Browser enumerates files and alerts the valid content URI path.
5. Open the enumerated `content://150@media/external/file/<n>` in Samsung Browser to view the locked Secure Folder file.
6. Use XHR to exfiltrate the file contents to an attacker server.
**How found:** Researcher noted Secure Folder uses multi-user storage (user 150) and that content provider URIs were not blocked in Samsung Browser; used script src onload/onerror enumeration (idea credited to F-Secure Labs) to brute-force file numbers.
**Exploitation:** Attacker sends an HTML file via WhatsApp; victim opens it in Samsung Browser, which enumerates Secure Folder content URIs via script onload/onerror side channels, then the attacker (or victim-opened page) reads the file via content URI and exfiltrates with XHR while Secure Folder is locked.
**Insight:** Multi-user Android storage (user 150 for Secure Folder/work profiles) creates parallel content:// namespaces; test whether browsers and content providers enforce profile lock state on cross-user media URIs, and use script onload/onerror as a blind oracle to enumerate file IDs.