Samsung: check the November security update on your device
November’s SMR fixes include local and physical-access flaws. A published bulletin does not mean every Galaxy has received it: check the model and installed security index.
Getting started
Generated image · SecuFocus
At a glance
Key points
Samsung has published its November 2026 security bulletin. If you use one of its Android devices, check the update offered for your model, then the security index actually installed. The manufacturer announces SMR Nov-2026 Release 1 but says delivery times vary by model and region. An available bulletin is not an update already installed on your phone.
Check both the bulletin month and the device
November’s SMR package combines Google and Samsung fixes. The manufacturer says its Samsung security index, or SSI, SMR Nov-2026 Release 1 includes the package’s Samsung and Google patches. The index appears in the security software version information. Keep the exact model and Android version too: seeing November on a web page is not enough.
Samsung warns that some OS upgrades can delay delivery and that chipset fixes received later may arrive in a subsequent package. This does not establish that a model missing from your update screen has been abandoned, or that every Samsung device is already patched.
The bulletin history now lists revision 1.1 on 5 November as a CVE-list change. Its Google list no longer contains CVE-2026-49925, which was present in our previous capture. Samsung gives no reason here: we infer neither removal of an installed fix nor a new version already delivered to every device. The three Samsung examples below remain in the bulletin.
The examples in the bulletin have different attack conditions
Among the High-rated fixes, Samsung describes CVE-2026-21155 in the bootloader: an attacker with physical access can write out of bounds. CVE-2026-21153 affects libsecuibc.so and allows a local attacker to execute code. For CVE-2026-21152 in libMyFilterPlugin.camera.samsung.so, the manufacturer specifies a local attacker, potential code execution and required user interaction.
Those three entries cover Android 14, 15, 16 and 17 before SMR Nov-2026 Release 1. They are specific examples, not a summary of every flaw in the package. They do not establish that receiving a message remotely exploits these three defects. Physical access, local access and required interaction must remain attached to the correct entry.
Use the manufacturer’s update route, then check the result
Before updating, check that your backup and account recovery methods remain accessible. Use the system update offered for your device or your administrator’s update route, allowing enough battery and time for the restart. Afterwards, read the version and security index again and check the functions you rely on.
If the package is not offered, ask the manufacturer or fleet administrator to confirm the model’s schedule and included fixes. Do not pick an arbitrary firmware download to match a date. If a device no longer receives fixes, review its uses and replacement rather than assuming a security app can replace OS updates.
This article reports the manufacturer’s bulletin. SecuFocus inspected no phone, installed no package and reproduced none of these flaws. The SMS of Death telephony issue is covered separately: conditions and rollout evidence do not transfer between advisories.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.