Samsung also closes 24 of its own Galaxy flaws; the rollout has so far reached only South Korea.
Key points
- Google’s Android Security Bulletin of 2 November 2026 (updated 6 November) closed several flaws rated “Critical”, including one that Google says can be exploited without any action by the user (CVE-2026-58868).
- Samsung published its own SMR-NOV-2026 security update on 3 November 2026 (updated 5 November), fixing a further 24 Galaxy-specific vulnerabilities.
- According to Samsung’s own firmware update log, the patch has been rolling out to the Galaxy S26 range since 9 November 2026 – so far only in South Korea.
- No source currently gives a rollout date for the UK; the National Cyber Security Centre (NCSC) generally advises installing security updates as soon as they become available.
Google and Samsung released their monthly security updates in early November. One of the flaws can be exploited without a single tap, and there is still no rollout date for Galaxy devices in the UK.
The first week of November is traditionally patch season for Android manufacturers: Google publishes its monthly security bulletin, and device makers such as Samsung fold the fixes into their own updates while adding patches for flaws in their own software layers. This month, one of the closed flaws is especially serious – and the rollout to devices is only just getting under way.
The critical flaw that needs no click
At the centre of the Android Security Bulletin of 2 November 2026 is, according to Google, a vulnerability tracked as CVE-2026-58868 in the Android Framework, a core component of the operating system. Google rates it “Critical” and states that it can be exploited remotely without additional privileges or any action by the user – security professionals call this kind of attack path “zero-click”.
The Google bulletin also lists further flaws rated “Critical” and “High” in system components from various chipmakers. Whether a given flaw affects a specific device depends on its processor and Android version. Google states that the security patch level of 5 November 2026 or later addresses every issue named in the bulletin.
Samsung’s 24 own Galaxy flaws
In addition to Google’s Android fixes, Samsung publishes its own monthly security update for Galaxy devices. The current update, named SMR-NOV-2026, was released on 3 November 2026 and updated on 5 November. In it, Samsung says it fixed 24 so-called Samsung Vulnerabilities and Exposures (SVE) – flaws that exist solely in Samsung’s own software, for example in pre-installed apps or customised system components.
Of these 24 flaws, Samsung discloses details on 17: three are rated “High” and 14 “Moderate”. The remaining seven are not described in detail in the bulletin; Samsung merely states that some SVE entries cannot currently be disclosed. This is standard practice when a flaw is only described in full once enough devices have received the patch.
Rollout: South Korea first, UK still waiting
According to Samsung’s own firmware update log for the Galaxy S26 (model SM-S942N), the firmware with build number S942NKSS6BZK1 was released on 9 November 2026 and carries the security patch level of 5 November 2026. The log lists the update for the South Korean market; a build for UK Galaxy S26 devices is not yet listed.
Samsung generally rolls out its monthly updates in stages – staggered by country, carrier and device model, sometimes over several weeks. No date can currently be inferred for the UK from the available sources. After the Galaxy S26 series, the Z Fold8 and Z Flip8 foldables are likely to follow next. All unpatched devices running the Android versions named in the bulletin remain affected by the underlying flaws, regardless of manufacturer.
Checklist: what you can do now
- Check Settings > Software update (on Samsung devices) or Settings > System > Security update to see which patch level is installed.
- Leave automatic updates switched on so the patch installs as soon as it is released for your device.
- Keep downloading apps only from the Google Play Store and leave Google Play Protect switched on – this reduces risk regardless of when the update arrives.
- Do not install unofficial firmware from third-party sites just to get the patch sooner.
Anyone with an older Galaxy model that no longer receives monthly security updates remains affected by the underlying Android flaws. Samsung lists the update periods for its models on its own support page.
Frequently asked questions
Is my Samsung Galaxy device affected by the zero-click flaw even if I haven’t had the update yet?
In principle, yes, if the device runs one of the Android versions named in the Android bulletin and has not yet installed the 5 November 2026 patch. The risk only falls once the update is installed.
What does “zero-click” mean for a security flaw?
It means attackers can exploit the flaw without the affected person having to click, open or confirm anything. According to Google, that is the case with CVE-2026-58868 in the Android Framework.
When will Galaxy users in the UK get the update?
That is still open according to the available sources. Samsung rolls out its updates in stages by country, carrier and model; so far, Samsung’s own log lists the November update only for the Galaxy S26 series in South Korea.
Which flaws affect Galaxy devices specifically, and which affect all Android phones?
The flaws named in the Google bulletin, including CVE-2026-58868, generally affect all Android devices running the named versions. The 24 SVE flaws from Samsung’s own update affect only software that Samsung itself adds on top of Android.
Sources and status
- Android Open Source Project: Android Security Bulletin November 2026, published 2 November 2026, updated 6 November 2026
- Samsung Mobile Security: SMR-NOV-2026 bulletin, published 3 November 2026, updated 5 November 2026
- Samsung: official firmware update log for the Galaxy S26 (SM-S942N)
- National Cyber Security Centre (NCSC): general guidance on installing security updates
Research and data as of: 14 November 2026.
Transparency note: AI-assisted tools were used in researching, structuring and writing this article. The sources used are listed in the article. Publication takes place only after manual editorial approval. Country edition based on an article from Net Trends, researched for the United Kingdom. Image note from the original: symbolic image of a secured smartphone.
Share this article
