Samsung also closes 24 of its own Galaxy flaws; the rollout has so far reached only South Korea, and in the US carrier approval adds another step.
Key points
- Google’s Android Security Bulletin of November 2, 2026 (updated November 6) closed several flaws rated “Critical,” including one Google says can be exploited with no action from the user at all (CVE-2026-58868).
- Samsung published its own SMR-NOV-2026 security update on November 3, 2026 (updated November 5), fixing 24 additional Galaxy-specific vulnerabilities.
- Per Samsung’s own firmware update log, the patch has been rolling out to the Galaxy S26 lineup since November 9, 2026 – so far only in South Korea.
- No source lists a rollout date for the US yet; in the US, carriers such as Verizon, AT&T and T-Mobile must each approve an update before it reaches their customers, which can add further delay on top of Samsung’s own staggered rollout.
Google and Samsung rolled out their monthly security patches in early November. One flaw can be exploited with zero clicks, and US Galaxy owners still have no rollout date.
The first week of November is traditionally patch season for Android makers: Google publishes its monthly security bulletin, and phone makers like Samsung fold those fixes into their own updates while adding patches for flaws in their own software on top of stock Android. This month, one of the closed flaws is unusually serious – and the rollout to actual devices is just getting started.
The critical flaw that needs zero clicks
At the center of the November 2, 2026 Android Security Bulletin is a vulnerability Google tracks as CVE-2026-58868, located in the Android Framework, a core piece of the operating system. Google rates it “Critical” and says it can be exploited remotely without extra privileges or any action by the user – security researchers call this kind of attack path “zero-click.”
The Google bulletin also lists additional flaws rated “Critical” and “High” in system components from several chipmakers. Whether any of them affects a particular phone depends on its processor and Android version. Google states that the security patch level of November 5, 2026 or later resolves every issue named in the bulletin.
Samsung’s 24 own Galaxy flaws
On top of Google’s Android fixes, Samsung ships its own monthly security update for Galaxy devices. The current update, called SMR-NOV-2026, came out on November 3, 2026, and was updated on November 5. Samsung says it fixed 24 so-called Samsung Vulnerabilities and Exposures (SVE) in it – flaws that live entirely in Samsung’s own software, such as pre-loaded apps or customized system components.
Of those 24 flaws, Samsung publicly describes 17: three are rated “High,” 14 “Moderate.” The remaining seven aren’t detailed in the bulletin; Samsung simply says some SVE entries can’t currently be disclosed – standard practice when a flaw’s full details are held back until enough devices have received the fix.
Rollout: South Korea first, carrier approval next
According to Samsung’s own firmware update log for the Galaxy S26 (model SM-S942N), firmware build S942NKSS6BZK1 came out on November 9, 2026, carrying the November 5, 2026 security patch level. The log lists the update for the South Korean market; a build for US Galaxy S26 devices isn’t listed there yet.
Samsung typically staggers its monthly updates by country, carrier and model, sometimes over several weeks. In the US, carrier-locked and carrier-branded devices also need sign-off from the carrier itself – Verizon, AT&T, T-Mobile and others each test and approve updates before they go out over the air, a step that doesn’t apply the same way in South Korea’s more unified market. No date for the US can currently be worked out from the available sources. All unpatched devices running the Android versions named in the bulletin remain exposed to the underlying flaws, regardless of maker.
Checklist: what you can do right now
- Check Settings > Software update (on Samsung devices) or Settings > System > Security update to see which patch level is installed.
- Leave automatic updates turned on so the patch installs the moment it’s approved for your device and carrier.
- Keep downloading apps only from the Google Play Store and leave Google Play Protect turned on – that lowers risk no matter when the update lands.
- Don’t install unofficial, third-party firmware just to get the patch faster.
Anyone on an older Galaxy model that no longer gets monthly security updates remains exposed to the underlying Android flaws. Samsung lists update support windows for its models on its own support page.
Frequently asked questions
Is my Samsung Galaxy affected by the zero-click flaw even if I haven’t gotten the update yet?
Generally yes, if your device runs one of the Android versions named in the Android bulletin and hasn’t installed the November 5, 2026 patch yet. The risk only drops once the update is installed.
What does “zero-click” mean for a security flaw?
It means attackers can exploit the flaw without the affected person clicking, opening or confirming anything. Google says that’s the case with CVE-2026-58868 in the Android Framework.
When will Galaxy owners in the US get the update?
Still unknown based on available sources. Samsung stages its rollouts by country, carrier and model, and in the US each carrier has to approve the update separately; so far Samsung’s own log lists the November update only for the Galaxy S26 series in South Korea.
Which flaws hit Galaxy phones specifically, and which hit all Android phones?
The flaws in the Google bulletin, including CVE-2026-58868, generally affect all Android devices running the named versions. The 24 SVE flaws from Samsung’s own update affect only software Samsung itself adds on top of Android.
Sources and status
- Android Open Source Project: Android Security Bulletin November 2026, published November 2, 2026, updated November 6, 2026
- Samsung Mobile Security: SMR-NOV-2026 bulletin, published November 3, 2026, updated November 5, 2026
- Samsung: official firmware update log for the Galaxy S26 (SM-S942N)
- Cybersecurity and Infrastructure Security Agency (CISA): general guidance on patching known vulnerabilities
Research and data as of: November 14, 2026.
Transparency note: AI-assisted tools were used in researching, structuring and writing this article. The sources used are listed in the article. Publication takes place only after manual editorial approval. Country edition based on an article from Net Trends, researched for the United States. Image note from the original: symbolic image of a secured smartphone.
Share this article
