Samsung fixes major Secure Folder flaw that exposed hidden apps and files

Samsung has rolled out a critical fix in its latest One UI 8 update, addressing a serious vulnerability in the Secure Folder feature — a popular tool that lets users hide sensitive apps, photos, and files on Galaxy devices. The flaw previously allowed anyone with physical access to the phone to peek into what was meant to be a private space.

What was the issue?

Secure Folder is designed to act as a locked, sandboxed environment within your phone, protected by a passcode or biometric verification. Users can move private content into it, confident that it will remain hidden. However, a flaw discovered earlier this year compromised that confidence. Due to how Samsung originally implemented Secure Folder — as a “work profile” — certain core Android system components, particularly Google’s Photo Picker and Permission Controller, failed to recognise it as a secure area.

As a result, these components could leak information about which apps were installed or which photos were stored in Secure Folder, even if it was locked. This was a fundamental security oversight, especially considering that the main function of Secure Folder is to hide sensitive content from unauthorised access.