On top of rolling out new AI tools and features to millions of Galaxy phones via One UI 8.5 and the One UI 9 beta, Samsung has released its June 2026 security update that patches up to 45 vulnerabilities across Galaxy devices running Android 14, 15 and 16.
This is alongside bringing some new Galaxy S26 features to the Galaxy S25 with the update. The patch fixes a real “local attacker” exploit and a handful of other security issues that are absolutely worth your attention.
Read on for more and don’t forget to subscribe to my newsletter for more Samsung news and deal updates.
Samsung’s One UI 8.5 June Update Patches A “Local Attacker” Exploit
Among the Samsung-specific One UI 8.5 June patches this month are fixes for bugs in the Galaxy’s photo editing tools, audio system, messaging settings and deep settings. Each involves what Samsung classifies as a “local attacker” exploit.
A local attacker isn’t someone breaking into your phone remotely from across the internet. It means someone who already has a foot in the door, either through a dodgy app already running on the device, or through physical access to the phone itself.
A malicious app is the more common version of a local attacker exploit. These are usually sideloaded from outside the Google Play Store or one that slipped past Play Protect.
“The everyday one is malicious code already running on the phone,” Shahak Shalev, Global Head of AI and Scam Research at Malwarebytes, told me. “A user gets tricked into installing a sketchy app beforehand…and that app uses a bug like this to break out of its sandbox and grab privileges it was never supposed to have.”
The other form is someone who has your phone in their hands. That could be a repair technician with unsupervised access, or simply someone picking up your unlocked phone while you’re not looking. Make sure you turn on the privacy screen feature if you have a Galaxy S26 Ultra so your unlock password isn’t visible to others.
Why You Should Install The June One UI 8.5 Update Now
The moment Samsung publishes a patch like this, a clock starts for anyone who delays updating.
“Some bad actors actually wait for these updates to drop, then compare the patch to reverse-engineer the very bug that just got fixed, so they can jump on people who haven’t updated yet,” Shalev told me.
This creates a so-called “n-day” or “1-day” exploit, which is a working attack built directly from the public fix, aimed squarely at anyone still running the unpatched version.
The good news is that these are local vulnerabilities and nobody is hacking your phone miles away. But the window between a published patch and hackers trying their luck on your device can be short. Updating fast is the one thing that fully protects your Galaxy entirely.
With that said, Malwarebytes confirmed it is not aware of any active campaign exploiting these specific vulnerabilities in the wild yet. But that doesn’t mean you shouldn’t follow basic security practices, or delay updating.
“The boring fundamentals are what keep you safe: stick to official app stores, be skeptical about sideloading APKs from random links, keep an eye on the permissions your apps are asking for, and…install your security updates promptly,” Shalev said.
How To Install The June One UI 8.5 Update
Samsung started rolling out the June patch on the 10th, beginning with the Galaxy S26 series in South Korea. The rollout has since expanded to the S25 series, S25 FE, S25 Edge, Z Fold 7, Z Flip 7, Z Flip 7 FE and Z Tri Fold, according to SammyFans.
As of today, June 15th, Samsung update tracker Tarun Vats confirmed the June update is now live for Galaxy S25 and S26 series users in Europe and India. The S24 series and older flagships are expected to follow shortly.
To check for the One UI 8.5 June update, go to settings > software update > download and install. It’s worth noting that availability depends on individual device support lifecycles. So if your Galaxy is no longer receiving security updates, this month’s patch may not be available for your phone and that means it’s time to upgrade.
