Quick answer: Samsung’s October 2026 security release (SMR Oct-2026 Release 1) was published on October 6 and covers Google’s October Android fixes plus Samsung’s own. Open Settings > Software update on your Galaxy phone, install it, and update Samsung Internet to version 30.0.5.24 or later. Google’s bulletin reports no active exploitation of the October Android flaws.
Samsung released its monthly security bundle on October 6, 2026. According to TechRepublic, it fixes nine critical, 33 high and three moderate Android vulnerabilities, along with a set of Samsung-specific issues.
It matters for anyone with a recent Galaxy phone in the US, UK, Canada, Australia or Europe. Rollout timing differs by model, region and carrier, so some people will see the update days or weeks after others.
What does the October Samsung security update fix?
The release bundles Google’s October Android Security Bulletin (dated 2026-10-01) with fixes from Samsung and Samsung Semiconductor. Samsung’s bulletin lists 45 Google CVEs applied: 9 critical, 33 high and 3 moderate. It also lists four high-severity fixes from Samsung Semiconductor.
Samsung’s page says it covers 27 Samsung Vulnerabilities and Exposures (SVE) items, but only 13 are described publicly: six high and seven moderate. The page does not explain the gap, and some details are withheld for security reasons.
Which critical flaws are included?
TechRepublic reports that four critical flaws sit in the Android System component (CVE-2026-55269, CVE-2026-55280, CVE-2026-58835 and CVE-2026-58880). They affect Android 16, Android 16 QPR2 and Android 17. Google says the most severe one allows local privilege escalation with no user interaction.
A fifth critical flaw, CVE-2026-58865, is in the Android Framework and could allow a remote denial of service without user interaction.
What are the Samsung-specific fixes?
- CVE-2026-21114: an out-of-bounds write in a Samsung media library (Android 14 through 17) that could allow local code execution.
- CVE-2026-21120: a use-after-free in the WSM service that could allow code execution with system privileges.
- CVE-2026-21122: a flaw in the text-to-speech library.
- HEIF image-processing fixes that could lead to arbitrary code execution.
Samsung’s page notes that some items affect only selected Android 16 and 17 devices, and one applies only to Android XR 14.
Is this update being used in attacks?
According to TechRepublic, Google’s bulletin reports no active exploitation of the October vulnerabilities. That is reassuring, but it is not a reason to wait. Public bulletins give attackers a map of what was fixed, and unpatched phones stay exposed to those flaws.
Most of the listed issues are described as local, meaning an attacker would need code already running on the phone, for example from a malicious app. That is another reason to install apps only from trusted stores.
How do I install it on my Galaxy phone?
- Open Settings and tap Software update.
- Tap Download and install (wording varies by device and region).
- Restart when prompted.
- Update Samsung Internet from the Galaxy Store or Google Play. CVE-2026-21132, a high-severity input validation flaw that needs user interaction, is fixed in version 30.0.5.24.
- Check the patch level in the phone’s software information and confirm it shows October 2026.
A recent One UI upgrade does not guarantee every security fix is present, according to TechRepublic. Samsung’s own page warns that big OS upgrades can delay planned security updates, though the upgrade itself includes current patches.
Which Galaxy devices get it, and when?
Samsung says the release targets “major flagship models” first, with delivery timing varying by region and model. Some chipset-specific patches may arrive in later packages once vendors have them ready. Samsung also schedules monthly, quarterly or biannual updates depending on the device, so older or budget models may not get October’s bundle at all.
If your phone has not been offered the update, check again in a few days rather than downloading files from unofficial sites. For a broader look at software rollouts, read our piece on the One UI 9 rollout.
What else should I do to stay protected?
- Turn on automatic updates in the same Software update menu.
- Use passkeys or a password manager so a stolen password is less useful. See how to set up passkeys.
- Apple also patched an exploited flaw (CVE-2026-86950) in iOS 26.7.1 on September 28, reports The Hacker News; iPhone owners should update too.
- Review last month’s fixes in our September 2026 security updates roundup.
- Help Net Security expects more Microsoft, Adobe, Chrome and Firefox updates this month, so keep other devices current as well.
- Browse other more security guides for more patch guides.
Frequently asked questions
Is the October Samsung update urgent?
It contains nine critical Android fixes, so installing it promptly is sensible. Google reported no active exploitation of the October flaws, so there is no sign of an emergency.
Why does my phone still show an older patch level?
Delivery varies by region, model and carrier, and Samsung says OS upgrades can delay planned security updates. Check Settings > Software update again in a few days.
Do I need to update Samsung Internet separately?
Yes. The browser is updated through its own app store listing, and version 30.0.5.24 or later fixes CVE-2026-21132.
Does this apply to non-Samsung Android phones?
The Android flaws come from Google’s October bulletin, so other makers should ship similar fixes on their own schedules. The Samsung-specific items apply only to Galaxy devices.