Samsung has published its November 2026 security update for Galaxy phones and tablets, listing 206 fixes. The Security Maintenance Release, SMR-NOV-2026, published on 3 November, combines 178 Google Android fixes, four Samsung Semiconductor patches and 24 Samsung-specific firmware issues. It covers devices running Android 14, 15, 16 and 17, but Samsung has given no firm date for when each model will receive it.

The most serious Android flaw

The most serious Google flaw is CVE-2026-58868, a critical remote code execution flaw in the Android Framework that needs no extra privileges and no action from the user. Twenty of the Google items are rated critical. The fixes are split across two patch levels, 2026-11-01 and 2026-11-05, and only the later level includes the kernel and chip-vendor fixes. Samsung lists 178 Google items rather than the 216 in Google's own bulletin, because it lists the items that apply to Galaxy devices.

Smart Switch and Samsung apps

Samsung also disclosed 19 vulnerabilities in its own applications, PC utilities and other software, five high severity. Ten affect Smart Switch, the app that transfers data between phones: two are high severity, including CVE-2026-21166, an authentication flaw that could let an adjacent attacker install arbitrary apps, and CVE-2026-21167, which could bypass authentication. The fixes are in Smart Switch version 3.7.74.7, apart from CVE-2026-21169, fixed in 3.7.74.1. Samsung also fixed flaws in Samsung Health, Bixby, Samsung Pay for Galaxy Watch and Samsung Update.

How to check your phone

Galaxy owners should check Settings, Software update, Download and install, and look for the label SMR Nov-2026 Release 1 afterwards. App fixes arrive separately, so a firmware update alone does not confirm Smart Switch or Samsung Health are patched. Samsung has not said any of these flaws are being exploited.

Sources: Mobile & Apps and MalaysianWireless.