Samsung has committed to banning smart TV apps that expose users' internet connections to outside parties, following the discovery that apps on its platform were covertly turning televisions into residential proxy exit nodes.

The vulnerability was identified by Norwegian cybersecurity firm Mnemonic, which found that certain apps distributed through Samsung's smart TV app platform included functionality capable of routing third-party web traffic through a user's home internet connection. That traffic would appear to originate from the user's own IP address rather than from the actual requester Engadget.

One of the apps flagged by Mnemonic was a licensed Pac-Man game that Samsung had featured in the Editor's Choice section of its app store. Installing the app could turn a Samsung smart TV into a residential proxy exit node, allowing unknown third parties to route web requests through the device Mnemonic.

The mechanism is straightforward. Residential proxy SDKs embedded within an app can remain dormant after installation, activating later to route someone else's web traffic through the TV's connected internet. From the outside, that traffic looks like it comes from the TV owner's household IP address. This matters because residential IPs are difficult to distinguish from ordinary consumer traffic, making them valuable for circumventing geo-restrictions, scraping targets at scale, or obscuring the origin of automated and potentially malicious requests. The TV owner absorbs the bandwidth cost and, more critically, the reputational and legal exposure tied to whatever the proxied traffic is doing.

After TechCrunch contacted Samsung about the findings, Samsung said it would ban any apps that shared its users' internet connections TechCrunch. The company also said it would implement strict platform-wide developer policies explicitly banning residential proxy SDKs Engadget.

The issue extends beyond Samsung's ecosystem. LG separately said it would suspend any apps capable of turning a customer's TV into a residential proxy Krebs on Security. The parallel response from two major smart TV manufacturers indicates the problem is structural to the category rather than isolated to a single vendor's review process.

What makes this discovery worth attention is the attack surface it reveals. Smart TV app stores have historically operated with less scrutiny than mobile app stores, despite the devices sitting on home networks with access to other local devices. A residential proxy SDK dormant inside a casual game — one that Samsung itself promoted — illustrates how easily the trust model of a curated app store can be subverted when the monetization incentive for proxy operators aligns with the distribution reach of a popular consumer device.

The Pac-Man app's placement in the Editor's Choice section is a concrete data point here. Samsung's curation did not catch the embedded proxy functionality before promoting the app to users. The gap between editorial endorsement and actual security vetting is the kind of thing that platform operators tend to address reactively rather than proactively, and Samsung's policy announcement follows that pattern.

Samsung has framed its response as a platform-wide policy change rather than a targeted removal. Banning residential proxy SDKs at the developer-policy level is a meaningful step if enforcement follows, because it gives Samsung a clear basis for rejecting or removing apps without needing to prove that proxy traffic has already occurred. The dormancy of these SDKs makes detection after the fact harder; a policy-level prohibition addresses the problem at intake rather than at incident response.

LG's parallel commitment suggests the industry may be converging on a baseline norm: consumer devices should not silently serve as network infrastructure for unknown parties. Whether that norm holds will depend on enforcement rigor, not policy text.

There is also a broader lesson for anyone building or managing app ecosystems. Residential proxy networks are a commercial product category with legitimate use cases, but their deployment through consumer devices without informed owner consent crosses a line that is now being codified, at least by Samsung and LG. The pattern — SDK ships dormant, activates later, monetizes the host device's network identity — is not new in the mobile world. It is newer in the smart TV context, where fewer users think of the device as a general-purpose computer that can be repurposed without their knowledge.

For security teams advising consumers or managing home-network policies, the takeaway is direct: a smart TV is a networked compute device running third-party code, and it should be treated as such on any network where it has access to sensitive resources. Network segmentation for IoT and smart-TV devices has been best practice for years. Discoveries like Mnemonic's are the reason that guidance persists.