Samsung October 2026 security update: SMR Oct-2026 and Internet 30.0.5.24

If you own a Galaxy phone, One UI 9 is not the only update to watch this week. On October 6, 2026, Samsung published its SMR Oct-2026 Release 1 firmware security package and a separate Samsung Internet browser fix.

This is different from our US One UI 9 S25 / Fold7 / Flip7 rollout note and from Google’s Android October 2026 bulletin. Feature skins, Google’s patch level, and Samsung’s monthly Security Maintenance Release are three related checkboxes.

What Samsung published on October 6

Samsung’s October 2026 Security Maintenance Release (SMR Oct-2026 Release 1) says the package includes:

• Google Android Security Bulletin patches for the October 2026 package, including nine Critical CVEs (among them CVE-2026-55269, CVE-2026-55280, CVE-2026-58835, CVE-2026-58865, and CVE-2026-58880) plus many High and Moderate items
• Four Samsung Semiconductor High CVEs
• 27 Samsung Vulnerabilities and Exposures (SVE) items

Samsung says the security software version string SMR Oct-2026 Release 1 includes the Samsung and Google patches in that package. Timing still varies by model, region, and carrier. Your phone may not offer it the same day the bulletin lands.

Separately, Samsung’s October 2026 service / app security page (bulletin published October 6, 2026) lists app fixes you may get through Galaxy Store or Play updates. The headline home-user item is:

• CVE-2026-21132 (SVE-2026-2694) in Samsung Internet prior to 30.0.5.24: improper input validation that can let a remote attacker inject arbitrary script. User interaction is required. Fixed in 30.0.5.24.

That browser update is not the same as the phone firmware SMR. Update both when they appear.

Why One UI 9 alone is not enough

A big One UI feature update can still leave you on last month’s security patch level. Samsung and carrier pages for some US S25 / Fold7 / Flip7 One UI 9 packages still showed a September 2026 security level when those feature builds shipped. Confirm the security patch level and, when Samsung shows it, the security software version after any update.

Practical targets for this cycle:

• System security patch level 2026-10-01 or later when your model gets the October package (Google’s bulletin baseline)
• Security software version that includes SMR Oct-2026 Release 1 when Samsung has shipped that string for your device
• Samsung Internet 30.0.5.24 or later if you use that browser

How to update and verify on your Galaxy phone

Exact menu labels vary by One UI version. The habit is the same.

Firmware / system security update

1. Connect to Wi-Fi and plug in (or keep the battery comfortable).
2. Open Settings → Software update (sometimes under System).
3. Tap Download and install or Check for updates.
4. Install when offered. Restart if asked.
5. Verify:
   • Settings → About phone → Software information
   • Read Android security patch level. Prefer 2026-10-01 or later once your model has the October package.
   • If shown, check Security software version for SMR Oct-2026 / Release 1 language.

Samsung Internet (separate)

1. Open Galaxy Store or Google Play.
2. Update Samsung Internet.
3. Open the browser → menu → Settings → look for version / About. You want 30.0.5.24 or later.
4. If you also use Chrome on the same phone, update that app on its own schedule. See our Chrome 155 security note.

If Software update says you are current but the patch level is still September, wait for your model’s staged October SMR. Do not sideload random firmware from forums.

Notable Samsung-specific fixes (plain language)

You do not need every SVE memorized. A few High items Samsung disclosed in SMR Oct-2026 Release 1 are useful context:

• CVE-2026-21114: out-of-bounds write in a media library that could let a local attacker execute arbitrary code
• CVE-2026-21120: use after free in the WSM service that could let a local attacker potentially execute code with system privilege
• CVE-2026-21122: out-of-bounds write in Samsung’s text-to-speech library with arbitrary code execution risk

Those are local-attacker style bugs. They still belong on a patched phone. Install the SMR when your model gets it.

Do this / don’t do that

Do

• Check Software update for the October SMR, then confirm the security patch level date.
• Update Samsung Internet to 30.0.5.24 or later for CVE-2026-21132.
• Remember that One UI feature builds and monthly security packages are separate checkboxes.
• Update each browser you actually use (Samsung Internet, Chrome, and so on).

Don’t

• Do not assume One UI 9 already included SMR Oct-2026.
• Do not ignore Samsung Internet because you “already updated the phone.”
• Do not chase exploit writeups for the Critical Android System items. Patching is the job.
• Do not sideload unofficial firmware to “force” October on an unsupported or staged model.

Bottom line

Samsung’s SMR Oct-2026 Release 1 (published October 6, 2026) bundles Google’s October Android security package (including nine Critical CVEs) with 27 Samsung fixes and related semiconductor patches. Separately, update Samsung Internet to 30.0.5.24 or later for CVE-2026-21132. On your Galaxy: install the system update when offered, confirm the security patch level, update Samsung Internet, and do not confuse this with the One UI 9 feature wave. That is the whole job.

Image: Samsung Knox “Your privacy. Secured.” marketing art (Samsung Newsroom).