Samsung fixes major Secure Folder flaw that exposed hidden apps and files

Samsung

Samsung has rolled out a critical fix in its latest One UI 8 update, addressing a serious vulnerability in the Secure Folder feature — a popular tool that lets users hide sensitive apps, photos, and files on Galaxy devices. The flaw previously allowed anyone with physical access to the phone to peek into what was meant to be a private space.

Secure Folder is designed to act as a locked, sandboxed environment within your phone, protected by a passcode or biometric verification. Users can move private content into it, confident that it will remain hidden. However, a flaw discovered earlier this year compromised that confidence. Due to how Samsung originally implemented Secure Folder — as a “work profile” — certain core Android system components, particularly Google’s Photo Picker and Permission Controller, failed to recognise it as a secure area.

As a result, these components could leak information about which apps were installed or which photos were stored in Secure Folder, even if it was locked. This was a fundamental security oversight, especially considering that the main function of Secure Folder is to hide sensitive content from unauthorised access.

With the release of One UI 8, Samsung has reclassified Secure Folder from a “work profile” to a “private profile” — a newer type introduced in Android 15 to support Google’s Private Space feature. This small but important change means that key system apps now recognize Secure Folder as a genuinely private space, hiding its apps and content from unauthorised view.

Crucially, this protection only works when Secure Folder is fully hidden — not just closed. Hiding the folder not only removes its icon from your app drawer but also encrypts the data inside, stops apps from running, and prevents notifications from being sent.

While this patch is a significant improvement, Secure Folder still doesn’t support third-party launchers, such as Niagara Launcher, despite Android 15 allowing private profile support in custom launchers. Samsung hasn’t yet implemented the necessary APIs, but users are hopeful for future compatibility.