Your Galaxy is a month behind. Install the August security update

Samsung’s August maintenance release is on the phone. It closes eight Critical Android bugs plus 16 Galaxy-only holes, including a clipboard service that let a local app read what you copied. Open Settings, Software update, and look for SMR Aug-2026 Release 1. If the security patch date is still July, you are a month behind.

Overview

What broke

Samsung published the August 2026 Security Maintenance Release on 4 August. The CVE list was updated on 10 August and again on 14 August. Two layers sit in one package. Google’s Android fixes in this SMR include eight Critical CVEs (CVE-2026-25289, CVE-2026-28591, CVE-2026-28653, CVE-2026-28662, CVE-2026-45515, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884) and 30 High. Samsung says see the Android bulletin for those details. On top of that, Samsung lists 16 of its own SVE items for Android 14, 15, and 16.

The Galaxy-only rows that read like home problems:

• CVE-2026-21062 (SVE-2026-0916): SemClipboardService. An authorization bypass. A local attacker can read clipboard data. That is the password you just copied, the one-time code, the address you pasted into a form.
• CVE-2026-21064 (SVE-2026-1829): Weaver. Improper access control. A local attacker can make the device inoperable. Samsung rated this High.
• CVE-2026-21061 in Samsung Dialer: a remote attacker can reach a SIM-related function. User interaction is required.
• CVE-2026-21068 in libril_sem.so: a stack overflow that lets a privileged local attacker run code. The radio library is not a toy process.

Samsung marked these privately disclosed. The patch note for the clipboard row is one sentence: the patch adds proper authorization. The Weaver note says the patch adds proper access control checks. In English, a local app or a local user who should not have been allowed in, was. That is the hole.

Who is in range

Galaxy phones and tablets on Android 14, 15, or 16 that have not taken SMR Aug-2026 Release 1. Rollout is staggered by model and carrier. If Software update says you are up to date but the security patch date is still July, you are not done. You are waiting on the package. A Galaxy so old it no longer receives monthly SMRs will never see this release. That is a replacement, not a missing toggle.

Pixel, iPhone, and non-Samsung Android are a different updater. A Galaxy Watch is not this SMR screen. The tablet in the kitchen is this screen if it is a Galaxy.

What the vendor shipped

One package. Samsung’s security index, the line under Security software version, should read SMR Aug-2026 Release 1 after the install. That index is supposed to include the Google patches and the Samsung SVE items. The Android security patch date should read August 2026. The day on that line may say 1 August or 5 August depending on the build. The SMR name is the one that settles the argument.

The in-phone path is Settings, Software update, Download and install. Keep the phone on Wi-Fi and power. After the restart, confirm under Settings, About phone, Software information. Carrier lag is real. Some models see the package the week of the bulletin. Some see it late in the month.

What this is not

• Not a Pixel update. Galaxy uses Samsung’s SMR. A Pixel owner wants the Pixel brief, not this screen.
• Not claimed in the wild. Samsung marked the SVE items privately disclosed. CISA has not listed them on KEV.
• Not “up to date” if Software update is quiet and the patch date is still July. Quiet is not patched.
• Not eight extra Critical bugs Samsung invented. Those eight Criticals are the Google Android layer. Samsung is shipping them in the same SMR.

The package is rolling. Take it when it appears. That is the cheap window.

Who can skip

• Software information already shows SMR Aug-2026 Release 1 and an August 2026 security patch.
• Pixel, iPhone, or a non-Samsung Android. This package is Galaxy-only.
• A Galaxy so old it no longer receives monthly SMRs. Software update will say you are up to date on an old patch. That is a replacement, not a toggle.

Why it matters

The clipboard fix is the one you feel. Copy a password from the manager, switch to the bank app, and on the old build a nasty local app could read the paste. People treat the clipboard as a private hallway. SemClipboardService is the hallway. Authorization bypass means the door did not check who was walking through.

Weaver is the other home-relevant High. Samsung’s words are local attackers can cause device inoperability. That is a brick of the session, not a doodle on a shared slide. The Dialer row is remote with a tap. The radio library stack overflow is a privileged local run-code. The eight Critical Android CVEs are the same class of bugs every OEM is supposed to ship in August. Samsung has not claimed in-the-wild use. The SMR is the close.

Carrier lag is how a July patch date survives into late August. The shop Galaxy on the counter, the tablet the kids use for homework, the phone you retired to the drawer as a backup camera: those are still Galaxy devices if they still boot. One Software update pass each. Samsung’s own disclaimer says OS upgrades can delay a planned SMR, and that delivery time varies by region and model. That is not a reason to skip the check. It is a reason to read Software information instead of trusting the toast.

The bottom line

Install

1. Unlock the Galaxy. Connect the Wi-Fi you already trust. Plug it in. A download this size does not belong on a dying battery.
2. Open Settings. On many One UI phones that is the gear on the home screen or in the app drawer.
3. Scroll to Software update. On some builds it sits inside About phone. Tap it.
4. Tap Download and install. If the phone asks to restart, let it. If it asks to use Wi-Fi only, stay on Wi-Fi.
5. Do not swipe the update away. Do not open Camera on top of the installer. Let the bar finish. The phone will restart itself.

Confirm

1. When the phone comes back, open Settings, About phone, Software information.
2. Find Android security patch. You want August 2026. The day may read 1 August or 5 August depending on the build.
3. Find Security software version. You want SMR Aug-2026 Release 1.
4. If both lines match, this Galaxy is done. If the patch date is still July, the package has not landed for this model and carrier yet.

If Download and install is missing

Check again tomorrow on Wi-Fi. Carrier lag is real. Samsung’s own bulletin says delivery time varies by region and model. The Members app sometimes shows a model-specific note. Do not sideload a firmware zip from a forum. That is how a security update becomes a brick. If Software update insists you are current and Software information still says July, you are waiting, not patched. Keep checking this week.

The tablet and the other Galaxy

1. Galaxy tablet: Settings, Software update, same confirmation lines. Tablets get the SMR on their own schedule.
2. A second phone in the house: same three taps. Do not assume the kids’ hand-me-down updated because yours did.
3. A Pixel in the same house is a different brief. It will never show SMR Aug-2026 Release 1. Use the Pixel System update screen for that one.

What you should see

Software information is a short list. Android version will still say 14, 15, or 16. That line does not move for an SMR. The two lines that do move are Android security patch and Security software version. August 2026 on the first, SMR Aug-2026 Release 1 on the second. If only one of those moved, you are not done. Some carriers ship a build that updates the Google patch date and leaves last month’s SMR name. Stay on Software update until both match. One UI may also show a Last update check time. That timestamp is not the patch.

When you are done

Software information shows SMR Aug-2026 Release 1 and an August 2026 security patch on every Galaxy you still use. That is the job. You do not need to reset the phone or revoke app logins. You needed the August package. You have it.