A cybersecurity expert, known as log4j, claims to have gained root access to a 2025 Samsung Smart TV, unearthing software designed for extensive user tracking. This discovery comes after he noticed highly specific advertisements appearing on his device.
Exploiting Tizen Firmware Vulnerabilities
The researcher explained that the Tizen operating system’s firmware was protected by AES encryption, making access impossible without physically modifying the hardware. He exploited zero-day vulnerabilities to open a root shell, capturing screenshots of the tracking features. Despite these findings, Samsung has not officially responded, and the results have yet to be replicated on an unaltered television.
Starting October 21, 2026, log4j detailed various tracking mechanisms on social media. These include automatic content recognition, screenshot capabilities, geolocation tracking, network mapping, targeted advertising, and user profile compilation. He also identified an advertising identifier (AID) that connects TV activity with other devices, and a regional neural network that monitors video interactions.
Audio Tracking Raises Concerns
One of the most controversial claims involves audio monitoring. According to log4j, a package called “always-on voice” within the firmware records events like barking dogs or crying babies. Even TVs without built-in microphones can use external audio devices, such as soundbars, for this purpose. Additionally, a component named rmdemon allows remote diagnostics by support staff.
Testing by Hugging Face engineer ngxson on a rooted Tizen TV with some features disabled showed that the microphone was activated for short intervals. However, the behavior of an unmodified TV might differ.
Legal Context and Industry Reaction
These claims emerge amidst ongoing legal scrutiny over similar tracking practices. On December 15, 2025, Texas Attorney General Ken Paxton filed a lawsuit against several TV manufacturers, including Samsung, for using automatic content recognition without consent. An agreement was reached in February 2026, requiring explicit consent from Texas consumers for data collection.
Reports indicate that even after disabling content recognition, Samsung and Vizio TVs continued sending related data. An earlier study revealed that smart TVs could fingerprint on-screen content, including HDMI inputs, to create advertising profiles. Samsung’s privacy notice confirms the sharing of video and audio snippets to enhance ad targeting.
Implications and Future Outlook
Log4j reports that data from these tracking mechanisms is shared with Samsung and approximately 400 partners. The company’s privacy policy states that third-party entities may receive device information and interaction records. On October 23, log4j shared that his OpenAI account was deactivated due to “Cyber Abuse,” though he denies using the platform for exploiting vulnerabilities.
Users concerned about privacy can deactivate Viewing Information Services on Samsung TVs through the settings menu. As cybersecurity threats evolve, it’s crucial to update defenses promptly to protect against new malware.
