CVE-2019-16256

What is the SIMalliance S@T Browser?

The SIMalliance Toolbox Browser (S@T Browser) is a legacy application that can be embedded on SIM cards to let mobile operators push simple value-added services — such as balance notifications or subscription info — directly to a subscriber's SIM, independent of the phone's operating system. Many operators no longer actively use it, but the software remains present and reachable on SIM cards across a large number of mobile networks worldwide, and it operates below the level of visibility of the phone's OS or security software.

Overview

CVE-2019-16256 is the vulnerability behind "Simjacker," a technique that allows an attacker to send a specially crafted SMS containing S@T Browser instructions directly to a victim's SIM card. Because the S@T Browser can execute a defined set of commands (retrieve location, retrieve IMEI, send SMS, launch a browser, and others) without any indication to the phone's user, an attacker can silently track a victim's location, retrieve device identifiers, or trigger other actions purely through the mobile network's signaling channel — no user interaction, no malware installation, and effectively no visible sign of compromise. CVSS 3.1 base score 9.8 (Critical).

Technical Details

The flaw is fundamentally a lack of authentication/access control on the commands the S@T Browser will accept from an incoming OTA (over-the-air) SMS: it does not verify that instructions genuinely originate from the subscriber's own mobile network operator, nor apply adequate sandboxing to the actions it can perform. Because the S@T Browser exists at the SIM level, its execution is invisible to the handset's operating system, meaning the victim receives no notification that a command has been executed against their device — an attacker sends a binary SMS, the SIM silently executes the embedded instructions, and (for example) responds with the device's location via a follow-up SMS to an attacker-controlled number.

Discovery

The vulnerability was discovered and disclosed by AdaptiveMobile Security in September 2019, which reported observing it actively exploited in the wild for months prior to disclosure by a surveillance vendor to track specific individuals across several countries, primarily by sending location-retrieval commands repeatedly over time.

Exploitation Context

CISA added CVE-2019-16256 to the KEV catalog in November 2021. AdaptiveMobile's original research described real-world, targeted exploitation against specific individuals rather than mass exploitation, consistent with commercial surveillance/spyware use rather than opportunistic cybercrime — though the underlying technique is applicable to any SIM running a vulnerable S@T Browser implementation, regardless of handset make, model, or OS.

Remediation

1. Mobile network operators should filter or block binary/OTA SMS messages that attempt to invoke S@T Browser commands from sources other than the operator's own trusted infrastructure.
2. Operators should audit which SIM profiles in their estate include the S@T Browser application and consider disabling or removing it where it is not used for legitimate services.
3. Deploy SMS firewall rules capable of detecting and dropping Simjacker-style OTA push messages at the network edge.
4. Enterprises with high-risk personnel should consult their mobile carrier about SIM-level protections, since this attack is invisible to handset-based mobile security software.
5. Individuals concerned about targeting can request their carrier confirm whether S@T Browser (or the related WIB browser) is present and active on their SIM.