Samsung October 2026 Security Update: What It Fixes, Who Gets It

On 6 October 2026 Samsung published the bulletin for the Samsung October 2026 security update: nine critical Android flaws, dozens of high-severity bugs and 27 Samsung-specific fixes. Four of the critical ones let an attacker gain higher privileges without you tapping anything, which is reason enough to install it when your phone offers it.

Below: what was fixed, in plain English, which Galaxy models have it, and how to check your phone is actually patched.

What the patch contains

Samsung’s monthly Security Maintenance Release (SMR) bundles two sets of fixes: Google’s Android Security Bulletin, and Samsung’s own patches for One UI, its apps and its chip components. According to TechRepublic’s breakdown of the bulletin, October’s release looks like this:

Samsung is holding back some SVE details for now, which is standard until enough devices are patched. TechRepublic and eSecurity Planet both report that none of the October flaws has been flagged as actively exploited. That doesn’t make the update optional. Once patches are public, attackers can study them.

The critical bugs, translated

Android System privilege escalation. Four critical bugs, CVE-2026-55269, CVE-2026-55280, CVE-2026-58835 and CVE-2026-58880, sit in the Android System component and affect Android 16, Android 16 QPR2 and Android 17. The worst could let a malicious app or local attacker gain higher privileges without extra execution privileges and without you tapping anything. That’s the kind of bug malware uses to break out of the app sandbox once it’s on a phone.

Android Framework remote denial of service. CVE-2026-58865 could allow a remote denial-of-service attack with no user interaction. Denial of service usually means crashes, or a phone that’s unusable until restarted, rather than stolen data. But “remote” and “no interaction” are the words that make security teams patch fast.

Samsung’s own high-risk fixes include:

• CVE-2026-21114, an out-of-bounds write in a Samsung media library (eSecurity Planet names it as libsmkvextractor.so) on Android 14 through 17, which could let a local attacker run arbitrary code. Media parsers are a classic target, because a booby-trapped video file can trigger them.
• CVE-2026-21120, a use-after-free in the WSM service that could let a local attacker run code with system privileges.
• CVE-2026-21122, a flaw in Samsung’s text-to-speech library that could allow arbitrary code execution.
• Fixes in HEIF image-processing components, which handle the photo format many phones use by default.
• More fixes for Locksettings and access controls, according to eSecurity Planet.

Samsung Internet is patched separately

The browser doesn’t update with the system. It comes through the Galaxy Store or Google Play. Samsung fixed CVE-2026-21132, a high-severity improper input validation flaw that could let a remote attacker inject script, in Samsung Internet 30.0.5.24. Exploiting it needs you to do something, such as visit a malicious page.

Open Samsung Internet, tap the three-line menu › Settings › About Samsung Internet. If the version is lower than 30.0.5.24, tap Update, or go to Galaxy Store › Menu › Updates.

Which Galaxy phones have it

Samsung puts supported devices on monthly, quarterly or biannual schedules, and timing varies by model, region and carrier. From rollout reports up to 25 October 2026:

The newest foldables went first, starting in South Korea. Sammy Fans reported the Galaxy S25 October patch landing in Korea on 19 October (builds ending in DDZJ2, such as S938NKSSDDZJ2 for the S25 Ultra) and in Europe a few days later (S93xBXXSDDZJ1). On the S25 series it also arrives as part of One UI 9.0 on Android 17, so check our One UI 9 rollout tracker for that schedule. US carrier models often trail unlocked ones by a week or more.

Installing it and confirming the patch level

1. Connect to Wi-Fi and charge to at least 50%.
2. Open Settings › Software update › Download and install.
3. If an update appears, tap Download, then Install now. The phone restarts once.
4. Check Settings › About phone › Software information › Android security patch level. It should say October 2026 (Samsung lists it as SMR Oct-2026 Release 1).
5. Update Samsung Internet and your other apps from Galaxy Store and Google Play.

Is your Galaxy still on the update list?

Not every Galaxy will get this patch. Samsung sorts supported devices into monthly, quarterly and biannual groups and eventually drops older models. A phone that has left the list stays on its last patch for good, however often you tap “Download and install”.

1. Find your exact model number in Settings › About phone (for example SM-S931B or SM-S931U for a Galaxy S25).
2. Open Samsung’s official Security Updates page (security.samsungmobile.com) and find your model in the monthly, quarterly or biannual lists.
3. Compare that with your current Android security patch level. On a monthly model more than two months behind, look for a pending update or a carrier delay.

Phones on quarterly or biannual schedules may skip the October release and get these fixes in a later bundle. That’s normal. What matters is that the patch level keeps moving forward.

Patch level as a used-phone health check

Privilege-escalation bugs are how a malicious app goes from nuisance to full compromise. Keep the phone updated, install apps only from trusted sources, and know the warning signs in our guide on how to tell if your phone is hacked.

If you’re buying second-hand, the patch level tells you a lot quickly. A Galaxy months behind may be an old model near the end of support, a carrier unit that hasn’t been updated, or a phone with a problem that blocks updates. Check:

• The security patch level in Software information, and that Software update actually runs.
• Model and region with a Samsung Info report, so you know which schedule applies.
• That it isn’t locked by Knox Guard or a finance provider. Our Knox Guard explainer shows what that looks like.
• Blacklist status, with a GSMA blacklist check.

Checklist for your own phone

• Patch level says October 2026 in Software information.
• Samsung Internet is on 30.0.5.24 or later.
• Apps are up to date in Galaxy Store and Google Play.
• Auto download over Wi-Fi is on, so next month’s patch arrives by itself.
• Any app you don’t recognise, especially one asking for Accessibility or device admin access, is gone.