1.0 Introduction
Recently, Samsung has released its October 2026 security update to address multiple vulnerabilities in Samsung mobile devices. The Security Maintenance Release includes fixes from Google’s Android Security Bulletin along with Samsung’s own patches, covering nine critical, 33 high and three moderate Android vulnerabilities, plus 27 Samsung-specific vulnerabilities
2.0 Impact
Successful exploitation of these vulnerabilities may allow an attacker to escalate privileges, cause a denial of service, or execute arbitrary code. Several of the Samsung-specific flaws could allow a local attacker to execute arbitrary code, and Google’s most severe System vulnerability could allow local privilege escalation without user interaction. A separate high-severity flaw in Samsung Internet (CVE-2026-21132) could allow a remote attacker to inject arbitrary script, although it requires user interaction. This may lead to execution of arbitrary code, unauthorised access to sensitive information and device compromise. Google has not indicated that any of the October Android vulnerabilities are being actively exploited.
3.0 Affected Products
?
Samsung mobile devices running
Android 14, 15, 16 and 17
?
Samsung Internet versions prior
to 30.0.5.24
4.0 Recommendation
CyberSecurity
Malaysia encourages users and administrators to review the following Samsung
security update page and apply the necessary updates. Users should check
Settings > Software update to install the October update, update Samsung
Internet to version 30.0.5.24 or later, and verify the device’s security patch
level. Organisations managing Galaxy devices should confirm patch levels across
all managed devices.
Kindly refer to the following URL:
Generally, we advise users to be
updated with the latest security announcements by the vendor and follow best
practice security policies to determine which updates should be applied.
For further enquiries, please contact Cyber999
Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References