A root shell on a Samsung TV proves your living room is an unpatched PC

Would you leave a networked Linux computer in your living room and never think about updating it for a decade? That is, more or less, what most of us do with our smart TVs.

The trigger is a GitHub repository whose author says they built working root exploits for two Samsung TVs they own: a QN90B purchased in 2022 and a QN90F purchased in July 2026. They use them to remap the remote and control their desktop. By the author's account, the older set took about a day with Codex in March 2026, and the newer one about three hours with a newer version of Codex. The repo says the chain starts from a package-name injection tracked as SVE-2025-50109, and that results hold only for exact models and firmware, so not every Samsung TV is affected.

The scary part isn't the hack, it's the clock

Let's be fair first. This is an owner's project, and the entry point involves Samsung's developer tooling. Bishop Fox analyzed a command injection flaw in the Samsung Debug Bridge service and described the direct risk as minimal: it needed developer mode enabled and an attacker at the configured host IP. Nobody is rooting your TV from another continent because of this.

But look at the trend line. In April, researchers at Calif described how Codex, starting from a shell inside the TV's browser app, climbed to root. It found world-writable device nodes, one of which let user space map raw physical memory, and then rewrote the browser process's credentials. The researchers say they gave it no bug and no recipe, though humans did have to redirect it at times. In our view, that is the real news: the cost of finding this kind of flaw is falling fast, while the TV on your shelf stays frozen in time.

And the flaws are not subtle. A kernel interface that hands out physical memory to any process is a design error, not an exotic bug. The TV in that research ran a 4.1.10 Linux kernel. We can't say how many sets like it are out there, but TVs tend to be among the longest-lived computers in a home.

Phone makers learned this lesson; TV makers are late

Phones have a reasonably understood contract: monthly, quarterly or biannual patches, and as eSecurityPlanet notes, older Samsung phones may move to less frequent updates as they age. You may not love it, but you know the deal.

TVs only recently got a version of one. Per the security updates page at samsungtvbounty.com, smart TV and monitor products launched from January 2023 are supported with security updates for 7 years from their initial launch. That is a real commitment, and credit where it's due. But note what it implies: the QN90B in this story, purchased in 2022, falls outside that promise. The set that was rooted in about a day is a 2022 purchase.

We also can't tell you, from the documentation, how fast any of these flaws get patched on a given set. That opacity is part of the problem.

What should happen

Our position is simple. Update commitments for TVs should be treated like those for phones: a guaranteed minimum, stated at the point of sale, with the end date visible. One forum thread from late 2023 noted that Samsung had the longest support then at 5 years, and that a legal requirement for smart devices was coming in April 2024. We can't verify the details of that rule from our sources, so treat it as a lead, not a fact. Still, the direction is right: regulation, not goodwill, is what should make a 7-year promise the floor rather than the exception.

For readers, practical advice:

• Keep automatic updates on, and check the model's support window before buying.
• Don't enable developer mode unless you need it, and never leave it on in shared spaces. Bishop Fox recommends kiosk mode for public TVs.
• Put the TV on a guest or separate network if your router allows it.

The living room has become a server room nobody administers. A root shell on a TV is a hobby today. The industry shouldn't wait for it to become something else before treating the screen like the computer it is.