KR 한국어로 보기

Samsung's November 2026 Galaxy Update Fixes the Modem Flaw Exploited on Pixel: Is Your Galaxy Affected?

Updated 11 min read

TL;DR

  • Google fixed modem flaw CVE-2026-58704 on Pixel on September 15; Samsung added the same fix to its Galaxy bulletin 49 days later, on November 3.
  • The flaw is in Samsung Exynos chips. Of the 70 Galaxy phones safeuntil tracks that still get updates (as of November 4), 25 have a sales version with an affected chip.
  • On November 4, Samsung's release notes showed no November patch yet for any of the 70 Galaxy phones safeuntil tracks on the update lists. From January to October, half of monthly-list phone updates came within 16 to 23 days of the bulletin, depending on region.

Google fixed CVE-2026-58704, a modem flaw that may have been exploited against Pixel phones, on September 15. Samsung added the same fix to its Galaxy security bulletin (SMR1 Nov-2026) 49 days later, on November 3. The flaw is in Samsung's Exynos chips, so the same Galaxy model can be affected in one country and not in another. A bulletin is not an update on your phone. On November 4, Samsung's release notes showed no November patch yet for any of the 70 Galaxy phones safeuntil tracks on the update lists.

When the modem flaw was found and fixed

NVD, the US vulnerability database, describes CVE-2026-58704 as a logic error in cellular modem code that skips a permission check. A nearby attacker can gain higher privileges without any action by the user.

  • September 15: Google published the fix in its Pixel bulletin and said there are indications the flaw may be under limited, targeted exploitation.
  • September 16: CISA2 added it to its catalog of exploited vulnerabilities. The entry names only Google Pixel as the product.
  • September 23: Samsung Semiconductor's page says the flaw was reported to the company on this date.
  • November 3: the fix first appeared in Samsung's Galaxy bulletin, under chip fixes. Of Samsung's 2026 bulletins from January to November, only the November one lists it.

Samsung Semiconductor lists the affected chips: its Exynos processors 850, 1280, 1330, 1380, 1480, 1580, 1680, 2200, 2400, 2500, 9110, W920, W930 and W1000, and its cellular modem chips 5123, 5300, 5400 and 5410. A Galaxy phone with a Qualcomm Snapdragon chip is not affected.

Samsung does not say which Galaxy models use these chips. So I looked up each model's chip name in the spec pages and press releases that Samsung publishes in each country.

Is your Galaxy affected?

Of the 83 Galaxy phones safeuntil tracks as of November 4, phones with an affected chip in a sales version: monthly list 11/35, quarterly list 14/35, support ended 2/13 (open full-size image)
Sources: Samsung Semiconductor CVE-2026-58704, Samsung spec pages and press releases by country, Samsung Mobile Security update scope. Chips checked November 4, 2026.

Samsung publishes a monthly list of models that get a security update every month and a quarterly list of models that get one every three months. As of November 4, safeuntil tracks 83 Galaxy phones, and 70 of them are on these lists. Of these 70 phones, 25 have a sales version with an affected chip. That is 11 of the 35 phones on the monthly list and 14 of the 35 phones safeuntil tracks on the quarterly list. The quarterly list also has phones that safeuntil does not track, mostly Galaxy M and F models, and this post does not cover them. The table lists only the versions whose chip I confirmed from a chip name Samsung published or from the CPU specs on Samsung Korea's support pages.

ModelChipConfirmed versionsUpdate list
Galaxy S23 FEExynos 2200Korea, EuropeMonthly
Galaxy S24, S24+Exynos 2400Korea, EuropeMonthly
Galaxy S25 FEExynos 2400Korea, US, EuropeMonthly
Galaxy S26 FEExynos 2500Korea, US, EuropeMonthly
Galaxy Z Flip7Exynos 2500Korea, US, EuropeMonthly
Galaxy Z Flip7 FEExynos 2400Korea, US, EuropeMonthly
Galaxy A54 5GExynos 1380US, EuropeMonthly
Galaxy A55 5GExynos 1480EuropeMonthly
Galaxy A56 5GExynos 1580US, EuropeMonthly
Galaxy A57 5GExynos 1680US, EuropeMonthly
Galaxy S22, S22+, S22 UltraExynos 2200EuropeQuarterly
Galaxy A14Exynos 850IndiaQuarterly
Galaxy A14 5GExynos 1330IndiaQuarterly
Galaxy A16 5GExynos 1330US, EuropeQuarterly
Galaxy A17 5GExynos 1330US, EuropeQuarterly
Galaxy A25 5GExynos 1280EuropeQuarterly
Galaxy A26 5GExynos 1380EuropeQuarterly
Galaxy A33 5GExynos 1280EuropeQuarterly
Galaxy A35 5GExynos 1380Korea, EuropeQuarterly
Galaxy A37 5GExynos 1480US, EuropeQuarterly
Galaxy A53 5GExynos 1280Korea, US, EuropeQuarterly
Galaxy XCover5Exynos 850EuropeQuarterly
Galaxy A13Exynos 850Korea, US, IndiaSupport ended
Galaxy Note20 Ultra 5GExynos 990 with Modem 5123BangladeshSupport ended

The last two rows are phones whose support has ended, so they are not among the 70. For the A14 and A14 5G, I found the affected chip only in the Indian versions. The European A14 5G uses a MediaTek chip. The Note20 Ultra 5G's Exynos 990 is not on the list, but Samsung Semiconductor says that chip works with Modem 5123, which is.

Your phone's model number, under Settings > About phone, tells you which version you have. The US Galaxy S24, for instance, is SM-S921U and the European one is SM-S921B. The US S24 uses a Snapdragon chip, so it is not affected. In countries not in the table, the same model can use a different chip. For example, the European S22 uses the Exynos 2200, but the Indian S22 uses a Snapdragon.

The S23, S23+, S23 Ultra, S24 Ultra, S25, S25+, S25 Ultra, S25 Edge, S26 Ultra, Z Flip4, Flip5 and Flip6, and Z Fold4, Fold5, Fold6, Fold7, Fold8 and Fold8 Ultra use Snapdragon chips in the US, Korea and Europe, so they are not affected. The Z Fold Special Edition and Z TriFold sold in Korea use Snapdragon chips too. The A05s, A27 5G, A36 5G, A73 5G, XCover6 Pro and XCover7 Pro use Snapdragon chips, so they are not affected either. The S21 FE uses a Snapdragon 888 or an Exynos 2100, and neither is on the list. The A04, A04e, A05, A06, A06 5G, A07, A07 5G, A15, A15 5G, A16, A17, A24, A34 5G and XCover7 use MediaTek chips, which are not on the list either. The S24 FE's Exynos 2400e and the Exynos 2600 in the Korean and European S26, S26+ and Z Flip8 are not on Samsung Semiconductor's list by name, so it is unclear whether they are affected.

The A13 and the Note20 Ultra 5G versions in the table also use an affected chip, but their support has ended, so they will not get the November update. On these phones the modem flaw stays unfixed. Plan a move to a phone that still gets updates.

When the November update reaches your phone

Samsung's bulletin announces which fixes go into the month's update. The update you install comes separately for each model and region. On November 4, I checked Samsung's release notes for each of the 70 phones on the update lists: none had the November patch yet. I used the Korean, European or US notes, and the Indian notes for the A04 and nine other phones.

From January to October 2026, counting each monthly-list phone in each month, half of the US unlocked updates came within 23 days of Samsung's bulletin. The median was 20 days in Europe and 16 in Korea. For each phone, I compared the first update that carried each month's patch level with that month's bulletin date. The median varied a lot from month to month: in the US, from about 9 days in April to 28 in August. The November bulletin came out on November 3. If November is a typical month, about half of the US unlocked monthly-list phones will have the update by around November 26.

Quarterly-list phones are updated at different intervals. The European S22's last three updates brought the February, May and August patches, on March 9, May 27 and September 3. If it keeps that three-month step, its next update brings the November patch. The August patch reached it 30 days after the August 4 bulletin.

Other fixes in the November update

Bar chart of Samsung's November 2026 update: 178 Google fixes, 4 chip fixes and 24 of Samsung's own fixes, by severity (open full-size image)
Source: Samsung Mobile Security, Security Updates SMR November 2026.

The November bulletin has 178 Google fixes, 4 chip fixes and 24 of Samsung's own fixes. Samsung published the number and description of only 17 of its 24 own fixes.

Of the Google fixes, 20 are rated critical. According to the Android Security Bulletin, the most severe flaw this month is in the Android framework and allows remote code execution with no extra privileges and no user action. CVE-2026-58704 is the only November fix in the October 30 version of CISA's catalog.

Check which November fixes your phone is missing

The Android phone pages on safeuntil ask for the Android version and security patch level shown in your phone's settings, count the known fixes for that Android version released after that patch level, and list up to 100 of them.

On November 3, I entered Android 17 and the security patch level 2026-10-05 on the Galaxy S25 page, a monthly-list phone. It counted 104 missing security fixes, all from November, and listed 100 of them. On the Galaxy S22 page, a quarterly-list phone, Android 16 and 2026-08-05 left 236 fixes missing, from September through November.

Chip fixes are not part of this check, so CVE-2026-58704 does not appear in the list. To see whether your phone has the November update, go to Settings > About phone > Software information. Samsung's bulletin lists the CVE-2026-58704 fix in its November release, and says that a phone showing SMR Nov-2026 Release 1 under "Security software version" has all of Samsung's and Google's November patches.

The October post shows where to find your patch level and how to install updates. If your model is in the table and on an update list, open Settings > Software update every few days and install the November update as soon as it appears. Do not put off the following month's update either.

Dates are as each source gives them: Google's bulletins in UTC, CISA's catalog in US time.

Sources

Footnotes

  1. SMR (Security Maintenance Release) is Samsung's monthly bundle of Galaxy security fixes, with Google's fixes and Samsung's own.

  2. CISA is the US Cybersecurity and Infrastructure Security Agency. Its KEV catalog lists vulnerabilities known to be exploited in real attacks.

Share

Back to Blog