KR 한국어로 보기

What Your Android Security Patch Level Date Means, and What the October 2026 Patch Fixed on Galaxy and Pixel

Updated 7 min read

TL;DR

  • The security patch level date is not the day you updated. It says which month of Android security fixes your phone has.
  • In October 2026 all 25 Android fixes went into 2026-10-01.
  • On a Pixel, 2026-10-05 adds 6 Pixel fixes.
  • No October 2026 bulletin marked any flaw as possibly exploited.

The date in your security patch level is not the day the update was installed. It tells you which monthly Android Security Bulletin from Google your phone has caught up to. A phone at 2026-10-05 has every fix from the October Android bulletin that applies to it. No October 2026 bulletin marked any flaw as possibly exploited.

What 2026-10-01 and 2026-10-05 mean

Google splits each month's Android bulletin into two patch levels, the 1st and the 5th. The September 2026 bulletin shows the difference. Its 2026-09-01 level had 90 fixes in Android's own code. Its 2026-09-05 level added 85 more, in the Linux kernel, in chip makers' parts and in a TV section.

So a phone at 2026-09-01 has those 90 September fixes in Android's own code and every earlier month. A phone at 2026-09-05 has every September fix that applies to it. A later date always includes the Android bulletin fixes of every earlier date.

In October 2026, Google put all 25 of its Android fixes into 2026-10-01. For the Android bulletin alone, both October dates mean the same fixes. A Pixel needs 2026-10-05 or later for the 6 Pixel fixes, says Google's Pixel bulletin.

Two things the date does not tell you:

  • The maker's own fixes. The Android bulletin says a patch level does not require the fixes in the maker's own bulletin. So the date alone does not show whether the maker's fixes are on the phone. Samsung shows a separate Samsung security index under "Security software version". Samsung's security bulletin says a phone at SMR Oct-2026 Release 1 has all of Samsung's and Google's October fixes.
  • Google Play system updates. On some phones with Android 10 or later, a few fixes also arrive through Google Play system updates. Three of October's 25 Android fixes also go out this way. So a phone can have those 3 before its security patch level shows October.

Where to find the date on a Galaxy or Pixel

  • Galaxy: open Settings, then Software update, then Last update. It shows the One UI version, Android version and security patch level of the last update (Samsung Canada). On some models the menu is called System updates (Samsung US).
  • Galaxy update: on the Software update screen, tap the check button. On US phones it reads Download and install, Check for system updates or Check for software updates, depending on your carrier (Samsung US). For security updates alone, go to Settings, then Security and privacy, then Updates, then Security update (Samsung Australia).
  • Pixel: open Settings, then About phone, then Android version, and look at "Android security update" (Google Help). To update, go to Settings, then System, then Software updates. A Pixel update becomes active after the next restart.

Not every phone gets the update on day one. Google said the October Pixel update rolls out "over the next week in phases, depending on carrier and device". Samsung says delivery time varies by region and model.

What the October 2026 patch fixed

Bars of October 2026 fixes by severity: Android bulletin 25, Pixel bulletin 6, and in Samsung's security bulletin 45 Google fixes, 4 chip fixes and 27 own fixes (open full-size image)
Sources: Android Security Bulletin, Pixel Update Bulletin and Samsung's security bulletin, October 2026.

The worst fix in the Android bulletin is critical. It closes a flaw that could let something on the phone raise its privileges with no user interaction. All 25 Android fixes are in Android's own code. Of the 6 Pixel fixes, 2 are in the kernel and 4 in Pixel parts such as Bluetooth.

Samsung's security bulletin has Google fixes, chip fixes from Samsung's chip division and Samsung's own fixes. Its 45 Google fixes include 23 of the Android bulletin's 25. Samsung marks the other 2 as already in an earlier update. Samsung lists 27 fixes of its own but describes only 13.

Was anything in the October 2026 patch exploited?

None of the three October 2026 bulletins has an exploitation note. When Google sees signs of attacks, its bulletins carry a line such as "There are indications that CVE-... may be under limited, targeted exploitation." The October Android and Pixel bulletins have no such line. Samsung's October section does not mention exploitation at all.

I also checked the 71 fixes that the three bulletins number against the list of exploited flaws that CISA, a US government agency, keeps. None of them was on CISA's list as released on October 23, 2026, at 19:30 UTC.

The September Pixel bulletin had one flaw with an exploitation note, and CISA added it to its list on September 16, 2026. A later date includes the fixes of every earlier date, so a Pixel at 2026-09-05 or later has that fix. The flaw is in the modem, and in Samsung's security bulletin it first appears in the November 2026 update.

Which models had 2026-10-05

Share of models whose newest patch level was 2026-10-05 on October 26, 2026: Pixel 6 and later 24 of 24, Galaxy US unlocked 5 of 29, AT&T 15 of 28, Europe 15 of 30 (open full-size image)
Sources: safeuntil data, Samsung's release notes per model. As of October 26, 2026.

On October 26, 2026, all 24 Pixel models from the Pixel 6 on that safeuntil tracks were at 2026-10-05. Galaxy phones differed by region and carrier. I read Samsung's release notes for the 30 tracked Galaxy models on Samsung's monthly or quarterly update lists. The US unlocked notes loaded for 29 of them and the AT&T notes for 28. 16 of them were at 2026-10-05 in at least one of two places: the US unlocked notes or the European notes.

The same model can be weeks apart. The Galaxy S25 got 2026-10-05 in Europe and on AT&T on October 22. Its newest US unlocked build, from October 6, was still at 2026-09-05.

How many fixes a month-old patch level misses

Every Android phone page on safeuntil has a "Check your phone's security patch level" form. Enter the Android version and the patch level from your settings. The page lists the fixes that came later and the patch level it gives for each one.

On October 26, 2026, I entered Android 17 and 2026-09-05. The Galaxy S25 page listed 34 fixes not yet on the phone, and the Pixel 9 page listed 28. A Galaxy S25 at SMR Oct-2026 Release 1 has all 34. A Pixel 9 at 2026-10-05 or later has all 28.

The form counts only fixes that the bulletins list for your Android version. On a Pixel, it also counts every Pixel bulletin fix, kernel fixes included. It skips chip fixes, Samsung fixes that name no Android version and fixes that also go out as Google Play system updates.

If the form lists missing fixes, check for an update on the settings screens above.

FAQ

My phone says it is up to date, but the patch level is months old. Why? The maker may not have sent that month's update to your model, region or carrier yet. The model may also be on a quarterly schedule, or its updates may have ended. Samsung puts some models on a quarterly list. On October 26, the Galaxy S22 and A53 5G were at 2026-08-05 in both the US unlocked and the European notes.

Sources

Share

Back to Blog