Critical Samsung Smart TV Vulnerability Exposes User Tracking, Allows Root Access

Key Takeaways

• A cybersecurity researcher, known as log4j, successfully gained root access to a 2025 Samsung Smart TV.
• The researcher uncovered extensive, deeply embedded tracking functionalities, including audio and video content recognition, geolocation, and user profiling.
• These tracking features are designed to collect significant user data, potentially for targeted advertising, even from external microphones.
• Samsung has not yet publicly addressed these specific findings. Users are advised to review privacy settings on their Smart TVs.

Samsung Smart TV Rooted: Researcher Uncovers Deep Tracking Capabilities

A cybersecurity researcher, operating under the pseudonym log4j, claims to have achieved root access on a 2025 Samsung Smart TV, subsequently exposing a sophisticated array of built-in software designed for comprehensive user tracking. The investigation was reportedly prompted by the researcher’s observation of unusually precise advertisements appearing on his personal television.

Unveiling Hidden Surveillance Features

Log4j detailed that the Tizen operating system’s firmware was secured with AES encryption, necessitating the discovery of zero-day vulnerabilities to bypass hardware-level key access. Upon gaining a root shell, the researcher documented numerous tracking functionalities through code screenshots. As of this report, Samsung has not issued a public response regarding these revelations, and the findings have not been independently replicated on an unmodified device.

Beginning with a series of posts on October 21, 2026, log4j itemized several concerning features. These included automatic content recognition (ACR), screenshot capture capabilities, geolocation services, network mapping, a dedicated targeted advertising service, and extensive user profile construction. The researcher also identified an advertising identifier (AID), which could potentially link television usage to other connected devices. Furthermore, a region-specific neural network was described as monitoring video playback, skipped advertisements, and viewer engagement with content. pic.twitter.com/EsxxCy1b6a

Concerns Over Audio Collection and External Microphones

Perhaps the most contentious claim involves audio surveillance. Log4j reported the presence of a firmware package named “csapi-tv-service-alwaysonvoice,” which he refers to as “always-on voice.” This component allegedly records telemetry on ambient sounds, such as a dog barking or a baby crying. Disturbingly, the researcher also asserted that a television lacking an integrated microphone could still leverage connected soundbars or Bluetooth devices to capture audio events. Another component, dubbed “rmdemon,” was described as a backdoor for support personnel to conduct brief diagnostics on the device.

In a related test, Hugging Face engineer ngxson examined a rooted Tizen television with various privacy settings already disabled. Tom’s Hardware reported that the microphone activated for a short five-second duration before deactivating, though an unmodified television’s behavior might differ.

Prior Legal Scrutiny and Ongoing Privacy Debates

These recent findings echo previous legal challenges concerning smart TV tracking. On December 15, 2025, Texas Attorney General Ken Paxton initiated legal action against Samsung, Sony, LG, Hisense, and TCL, citing unauthorized use of automated content recognition. Subsequently, on February 26, 2026, his office announced an agreement with Samsung, mandating that the company cease collecting ACR viewing data from Texas residents without explicit consent. While this agreement applies specifically to Texas, it does not validate or refute log4j’s new findings.

Previous reports by Cyber Security News indicated that both Samsung and Vizio televisions continued to transmit data consistent with content recognition even after users had manually disabled the feature. Earlier research highlighted on this platform also demonstrated smart TVs’ capability to fingerprint on-screen content, including HDMI input, to construct advertising profiles. Samsung’s privacy notice explicitly states that the company may share video or audio snippets with third-party providers to facilitate targeted advertising based on content being played.

Log4j asserts that collected data is shared with Samsung and approximately 400 partner entities. Samsung’s privacy policy does acknowledge that third parties may receive device information and records of user interactions with advertisements.

OpenAI Account Deactivation Raises Questions

On October 23, 2026, log4j publicly shared an email indicating that OpenAI had deactivated his account, citing “Cyber Abuse.” The researcher vehemently denied using OpenAI services for vulnerability discovery or exploitation, attributing the ban to local reverse-engineering activities that triggered an internal system he referred to as “Daybreak.” Log4j stated that this incident resulted in a financial loss of around $500 and spurred him to expedite further research. OpenAI has not provided a public explanation for this specific account termination. pic.twitter.com/RDxWAP3Bfs

What You Should Do

• Review Privacy Settings: Navigate to Settings > All Settings > General and Privacy > Terms and Privacy on your Samsung Smart TV. Ensure “Viewing Information Services” is disabled if you wish to limit ACR.
• Be Wary of Connected Devices: If you use external soundbars or Bluetooth microphones, understand that your TV might access these for audio collection, even if it lacks an internal microphone.
• Consider Network-Level Blocking: For advanced users, consider using network-level firewalls or DNS filtering to block known advertising and telemetry domains associated with your Smart TV.
• Stay Informed: Keep an eye on firmware updates from Samsung, as these may contain privacy enhancements or address reported vulnerabilities.
• Limit Personal Data on Smart Devices: Be mindful of the personal information you share or interact with on any smart device, including TVs, given the potential for extensive data collection.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.