In short: Samsung's August 2026 Security Maintenance Release (SMR-AUG-2026) closes 56 vulnerabilities across Galaxy devices — including 8 critical Android CVEs and 18 Samsung-specific flaws. The most notable fix plugs a clipboard-scraping hole that let any unprivileged app silently read your copied passwords and 2FA codes. If you own a Galaxy S23–S26, Z Fold 8, or Z Flip 8, check for the update now.
What happened: 56 fixes in one patch
On 4 August 2026, Samsung published bulletin SMR-AUG-2026, its monthly security package for Galaxy devices. The release addresses 56 vulnerabilities: 38 from Google's Android Security Bulletin and 18 in Samsung-proprietary One UI components and Galaxy services. Among the Google CVEs, eight carry critical severity — the highest possible rating — covering remote code execution and privilege escalation flaws. Details are documented by Comss.ru and Notebookcheck.
Affected devices span Galaxy S23 through S26, the foldable Z Fold 8 and Z Flip 8, mid-range A54 and A57 models, and Galaxy Tab variants running Android 14, 15, or 16. The rollout began on flagship S26 and foldable devices and reached older and mid-range models through August. For more on Android security trends, visit the LiMP VPN blog.
The key vulnerabilities: what threatened your data
Clipboard breach (SVE-2026-0916 / CVE-2026-21062) — the most critical. A flaw in SemClipboardService let any unprivileged local app read clipboard contents without permission. In practice: copy a password, a 2FA code, or a crypto wallet address, and a malicious app installed on the same device could harvest it instantly — no user action required.
Camera memory corruption (SVE-2025-2363, 2364, 2365 / CVE-2026-21058–21060). Three memory corruption flaws in the Camera component. This class of bug can allow a malicious app to execute arbitrary code in the camera process, potentially gaining access to photos and video streams.
Bluetooth privilege escalation (SVE-2026-0870 / CVE-2026-21070). An elevation-of-privilege flaw in the Bluetooth stack. Particularly relevant in high-density public spaces — malls, airports, cafés — where the device is continuously discoverable by nearby hardware.
Video codec buffer overflows (libsavsvc.so — SVE-2026-0615, 1053, 1813 / CVE-2026-21069, 21071, 21072). Multiple buffer overflow vulnerabilities in VC1 and MPEG4 video codecs. A crafted video file could trigger code execution during media processing.
Weaver hardware module (SVE-2026-1829 / CVE-2026-21064). Weaver protects biometric credentials and encryption keys. Before the patch, a local exploit could trigger security subsystem lockouts. Additional fixes landed in Contacts, Phone, Messages, Galaxy Themes, and AppLock.
Why you should update now
The clipboard vulnerability is especially damaging for anyone who copies passwords directly or relies on SMS-based two-factor authentication. Once a security bulletin is published, exploit developers reverse-engineer the patch to attack users who have not yet updated — this vulnerability window is typically measured in days, not weeks.
The eight critical Google CVEs involve remote code execution (RCE), meaning under certain conditions an attacker can run arbitrary code on the device without physical access. CVEs in this category typically score 9.0 or higher on the CVSS 10-point scale.
A useful free resource to check whether your email appeared in known breaches: HaveIBeenPwned — no registration required.
How to install the update
Go to Settings → Software Update → Download and Install. The update covers Galaxy S23–S26, Z Fold 8, Z Flip 8, Galaxy A54, A57, and Tab devices on Android 14, 15, and 16. If it has not appeared in your region yet, it will arrive within a few days — Samsung stages rollouts geographically.
Once your OS is patched, consider also encrypting your traffic on public Wi-Fi. The system patch seals OS-level flaws; LiMP VPN encrypts everything your device transmits across the network — the two layers are independent and complementary. Plans from ₽69/month: LiMP VPN pricing.