Samsung Reveals 38 Android Security Fixes Before Google Details

Samsung has disclosed details of 38 Android security vulnerabilities addressed in Google’s August 2026 Android security update, even as Google’s own security bulletin was published without listing any Common Vulnerabilities and Exposures (CVEs). Although Google stated that the August Android Security Bulletin “contains details of security vulnerabilities that affect Android devices,” the document did not identify any CVEs or specify how many flaws had been resolved.

The absence of vulnerability details follows a recent pattern seen with Chrome browser updates, where Google announces new releases before publishing CVE information a day or two later. A request has been made to Google seeking clarification on the delayed disclosure process.

Samsung’s August 2026 Security Maintenance Release bulletin for Galaxy devices filled in many of the missing details. Alongside 18 Samsung Vulnerabilities and Exposures (SVEs), the company confirmed that Google’s update includes fixes for 38 Android CVEs. According to Samsung, eight of those vulnerabilities are classified as critical under the Common Vulnerability Scoring System (CVSS), while the remaining 30 carry a high-severity rating.

Among the critical flaws identified, CVE-2026-25289 involves a memory corruption vulnerability in Android’s Neighbor Awareness Networking Service. CVE-2026-28662 is related to improper input validation, although additional technical information has not yet been published. CVE-2026-45515 could allow an attacker with local access to render a device inoperable and launch arbitrary activity. CVE-2026-49882 appears to be another input validation flaw affecting the Android dialer application on devices running Android 14, Android 15 and Android 16.

At the time of publication, no additional technical information was available for CVE-2026-28591, CVE-2026-28653, CVE-2026-49879 or CVE-2026-49884. More details are expected once Google and vulnerability tracking databases publish their findings.

It remains unclear whether the Android vulnerabilities were identified through Google’s internal security efforts or by external researchers participating in the Android Bug Bounty Program. Samsung, however, confirmed that several of this month’s Samsung Vulnerabilities and Exposures were discovered by independent security researchers through its Mobile Security Rewards Program. The disclosure comes shortly after Microsoft announced it had paid $20 million to ethical hackers over the past year for reporting security vulnerabilities.

Both Google and Samsung distribute security updates automatically through over-the-air updates, and users will receive notifications when patches become available for their eligible devices. However, Android’s fragmented ecosystem means update availability varies by manufacturer and model, unlike Apple’s iOS, where security updates are typically released simultaneously across supported devices. Until the update reaches their device, users have limited options beyond waiting and checking Google’s official Android support page for update instructions.