Loading story…
Samsung’s October 2026 security update addresses nine critical, 33 high-severity and three moderate-severity Android vulnerabilities, alongside Samsung-specific flaws. Critical Android System vulnerabilities could allow local privilege escalation, while an Android Framework flaw could enable remote denial of service without user interaction. Samsung-specific fixes address potential arbitrary code execution in media, WSM, text-to-speech and HEIF image-processing components. The Dutch NCSC also warned of vulnerabilities, including CVE-2026-45524, affecting Android 14 through 17 and Samsung Mobile devices, with potential consequences including unauthorized access, device takeover, data exposure or alteration, and service disruption, depending on the flaw.
Google’s bulletin did not indicate active exploitation, and the NCSC reported neither evidence of exploitation nor known publicly available exploit code, rating exploitation likelihood as medium. Google and Samsung have released fixes, and the NCSC recommends applying them promptly. A separate Samsung Internet update addresses CVE-2026-21132, a high-severity script-injection vulnerability affecting versions before 30.0.5.24. Enterprise administrators should verify both device security patch levels and Samsung Internet versions rather than assume a major operating-system upgrade includes all applicable fixes.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Samsung released details of its October security package, incorporating fixes for nine critical, 33 high-severity, and three moderate-severity Android vulnerabilities. It also disclosed 27 Samsung-specific vulnerabilities, including flaws in media, WSM, text-to-speech, and HEIF components that could enable arbitrary code execution.
The NCSC issued an advisory covering vulnerabilities affecting Android 14 through 17 and Samsung Mobile devices, including CVE-2026-45524, and recommended promptly applying available Google and Samsung fixes. It reported no evidence of active exploitation or known publicly available exploit code and rated exploitation likelihood as medium.
Samsung separately disclosed CVE-2026-21132, a high-severity input-validation vulnerability fixed in Samsung Internet version 30.0.5.24. The flaw could allow a remote attacker to inject arbitrary script, but exploitation requires user interaction.
Google released updates addressing Android vulnerabilities that could enable unauthorized access, malicious code execution, or disruption of device availability. Its October security bulletin included critical System privilege-escalation flaws and a Framework flaw permitting remote denial of service without user interaction.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Samsung’s September 2026 security update fixes two critical remote-code-execution vulnerabilities in Galaxy devices: `CVE-2026-21095` and `CVE-2026-21096`. The flaws are heap-based buffer overflows in the DNG and JPG decoders within `libimagecodec.quram.so`; successful exploitation could allow an attacker to execute arbitrary code remotely through a crafted image. The bulletin also incorporates applicable Android security fixes, including 18 critical and 40 high-severity issues reported by Google, plus 31 Samsung-specific fixes. Samsung says 40 of the Google-listed vulnerabilities do not affect Galaxy products. Updates cover supported devices running Android 14 through Android 17, though availability varies by device model, carrier, and region.
Sep 9, 2026
Samsung released its August 2026 Security Maintenance Release for Galaxy smartphones and tablets, patching **56 vulnerabilities** across supported devices running Android 14, 15, and 16. The update incorporates **38 fixes** from Google’s August Android Security Bulletin and **18 Samsung-specific patches** affecting One UI and Galaxy software, with Google’s share including **eight critical** and **30 high-severity** issues. Samsung said the device-specific fixes address components including **SemClipboardService**, **Samsung Contacts**, **Dialer**, **Messages**, **Galaxy Themes**, **AppLock**, media codecs, and the **Weaver** hardware component. The company also noted that nine vulnerabilities listed by Google were not included in the Galaxy update because one had already been fixed in July and eight did not affect Samsung devices due to unused hardware or configurations; rollout is expected to begin with newer flagship models before expanding to older supported Galaxy and A-series devices, while national CERT advisories have also flagged Samsung product vulnerabilities.
Aug 16, 2026
Google released its October 2026 Android security bulletin on October 5, addressing at least 25 vulnerabilities, including seven rated critical. The fixes cover local privilege escalation in the System component, remotely triggerable denial of service in the Framework, and remote code execution in Wi-Fi. Listed affected versions include Android 14, 15, 16, 16-QPR2, and 17. Google Play system updates dated October 1 also address vulnerabilities in Telephonycore and Wi-Fi. Google did not report active exploitation of the vulnerabilities. The Canadian Centre for Cyber Security and Guyana National CIRT urged users and administrators to review the bulletin and apply applicable updates as they become available. Samsung separately announced October updates covering nine critical, 33 high-severity, and three medium-severity vulnerabilities, with device delivery potentially taking days or weeks. Organizations should prioritize affected Android devices, verify both vendor security patches and Google Play system updates, and track devices awaiting rollout.
Oct 7, 2026