Samsung just detailed its October 2026 security update, which gives Galaxy owners a better look at background changes. The build brings up to 83 vulnerability fixes, including Samsung’s own fixes and core Android patches from Google. The company is already rolling out this update to the Galaxy S26 series, as well as the latest Galaxy Z Fold 8, Fold 8 Ultra, and Flip 8.
Cancel the Google and Samsung security fixes
A large part of this publication covers Android system vulnerabilities reported by Google. The package addresses 45 Common Vulnerabilities and Exposures (CVEs), with 9 critical severity issues, 33 high-risk bugs, and 3 moderate flaws. Google has selected CVE-2026-20519 and CVE-2026-20520 under the headline critical fixes. Samsung noted that three listed CVE elements have already been patched in previous updates. Meanwhile, Google hasn’t applied bugs to Galaxy hardware at all.
In addition to Google’s work, Samsung Mobile revealed 27 Samsung Vulnerabilities and Exposures (SVEs) that affect its own apps, software and services. Samsung Semiconductor also attacked four high-risk fixes. The company has withheld specific technical details on some bugs to prevent exploitation attempts. However, published notes detail memory security flaws about audio extractors, text-to-speech tools, and the HEIF image decoder library.
Critical defects and how to check your Galaxy device
Among the internal bugs detailed in the release notes, a use-after-free bug in the WSM service stands out, as it can run local attacker code with system privileges. Another high-severity fix addresses the Locksettings module, where a root-level local attacker could gain access to work profile data before the user completes their initial phone lock.
Samsung has confirmed that these fixes are available on devices running Android 14, Android 15, Android 16, and Android 17. You can check if the update has hit your device by going to Settings, tapping Security Software Version and searching for “SMR Oct-2026 Release 1.”