Galaxy S23 May 2026 Update Closes a No-Tap ADB Hole

Samsung’s May 2026 security update for the Galaxy S23 series closed two Google-rated critical holes, including an Android Debug Bridge bug that needed no tap. India got the builds first. Four months later the same phones are still riding a late monthly patch train, and the last promised OS upgrade is already in beta.

The May package was never a feature drop. It was the first security train after One UI 8.5, and it set the pattern the S23 has lived on since.

The May Build Closed a No-Tap Hole

Google published the May 2026 Android Security Bulletin on May 4, then added AOSP links on May 7. Devices on patch level 2026-05-01 or later pick up the fixes. Partners had been told at least a month earlier.

Samsung followed on May 6 with the May 2026 SMR for Galaxy devices, tagged SMR-MAY-2026 Release 1. Canada’s Cyber Centre flagged phones still sitting below that release the same day.

Samsung’s May list is blunter than a round “dozens of fixes” headline. It names two Google criticals, CVE-2026-0051 and CVE-2026-0073, then 27 Google highs. One extra Google item was already in an earlier package. Another did not apply to Galaxy hardware. Samsung also logged 10 of its own SVE items and published seven of them.

THE MAY 2026 SMR MIX

• Google criticals: CVE-2026-0051 and CVE-2026-0073, both shipped in the May Galaxy package.
• Google highs: 27 issues spanning 2025 and 2026 CVE IDs, from system code through partner components.
• Samsung SVEs: 10 items in the index, seven written up, including a Watch-only high-severity bug and six moderate phone issues.
• Patch string: SMR May-2026 Release 1 is the index owners should see under Security software version after the install.

The published phone-side SVE write-ups are local or physical bugs: FactoryCamera identifiers, LocationManager data, Routines, SveService, OmaCP. They are ugly on a handset you carry every day. They are not the reason this month’s bulletin opened with a warning.

What CVE-2026-0073 Does on the S23

The load-bearing hole is CVE-2026-0073. Google’s table puts it in the System component and in the adbd Mainline module, and it hits Android 14, 15, 16, and 16-qpr2. The S23 series was already on Android 16 when the May patch landed, so it sat inside that set.

The issue in this bulletin is a critical security vulnerability in the System component that could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation.

Android Security Bulletin, May 4, 2026

That is a neighbor on the same network, not a stranger on the far side of the internet, getting a shell. No tap. No extra privilege dance. Google’s own wording is critical adjacent code execution as shell, and the AOSP fix landed in the adb module.

On a phone, adbd is the Android Debug Bridge daemon. It is the pipe developers use to install apps, pull logs, and open a shell. A patched 2026-05-01 level, or a Google Play system update that carries the same adbd date string, is what closes it. Leaving Wireless debugging on an open cafe network was already a bad habit. In May it was also a hole with a CVE.

CVE-2026-0051 is the other critical on Samsung’s May sheet. Google’s public May bulletin spent its system table on 0073, so 0051 should be treated as a second critical in the Galaxy package rather than as a second fully documented write-up.

India Got the May Firmware First

Stable One UI 8.5, based on Android 16, reached the Galaxy S23, S23+, and S23 Ultra in Europe and India on May 21, after a South Korea start two days earlier. The build family was S91xBXXU9FZDP. The download was over 4GB for people who had not been on the beta. The US carrier-locked path followed on May 22 under S91xUSQU7FZE2.

The May security package came after that feature drop, not instead of it. In India the May 2026 security update used S911BXXSAFZE1 on the Galaxy S23, S916BXXSAFZE1 on the S23+, and S918BXXSAFZE1 on the S23 Ultra. Regional prefixes change. The FZE1 token is the tell.

Install path is the usual one: Settings, Software update, Download and install, on Wi-Fi, with battery to spare. Samsung’s own security page also warns that a big One UI upgrade can shove a monthly patch later, and that chipset-vendor fixes sometimes miss the month they were aimed at.

S23 BUILDS FROM MAY THROUGH AUGUST

The August international S911BXXSAFZH3 package was built on August 11 and carries the August 5, 2026 patch. Korea’s August S23 train used S91xNKSS8FZH2, about 390MB, and it went out on August 31.

Four OS Upgrades, Then a Security Tail

Samsung’s Gulf support page still tells S23, S23+, and S23 Ultra owners to expect four years of OneUI upgrades and five years of security updates. That clock started with the February 2023 launch on Android 13 and One UI 5.1. Five years from that launch runs through early 2028.

The policy itself is older than the phone. On February 10, 2022, Samsung said select Galaxy devices would get four generations of One UI upgrades and up to five years of security updates, with upcoming S series models on the list. TM Roh, then President and Head of MX Business, said customers were already keeping phones longer and that the new promise was built for that habit.

Eleven months after the S23 launch, the Galaxy S24 arrived in January 2024 with seven OS generations and seven years of security. The S23 did not get folded into that later deal.

THE S23 SOFTWARE PATH

• Launch stack: Android 13 and One UI 5.1 in February 2023.
• Major steps already delivered: Android 14 with One UI 6, Android 15 with One UI 7, Android 16 with One UI 8, then One UI 8.5 on Android 16 QPR2.
• Last major OS owed: Android 17 with One UI 9, now in beta on Indian S23 units.
• Security floor: monthly (sometimes late) patches through early 2028, then the five-year promise is spent.

One UI 8.5 is the awkward extra. It is still Android 16, but it is built on Google’s QPR2 platform drop, not the first Android 16 cut. The S22 series, which had already used up its four OS steps, did not get 8.5. The S23 did, because Android 17 was still on the IOU list. A 9.5 build on Android 17 QPR2 is the cut owners should not budget for.

August’s Patch Landed on the Last Day

After May, the S23 did not go quiet. It also did not stay on a crisp first-week cadence. July’s international S23 package was S91xBXXSAFZG1, about 400MB, after a Korea start. August’s Korea package waited until the last day of the month.

THE 2026 S23 PATCH CLOCK

1. May 4, 2026: Google publishes the May bulletin and names CVE-2026-0073.
2. May 6, 2026: Samsung publishes SMR-MAY-2026 Release 1.
3. May 21, 2026: Stable One UI 8.5 opens in Europe and India after a Korea start.
4. Late May 2026: India receives the FZE1 May security builds on the S23, S23+, and S23 Ultra.
5. July 2026: International S23 units move to S91xBXXSAFZG1, about 400MB.
6. August 31, 2026: Korea gets the August S23 package, about 390MB, on the last day of the month.
7. September 3, 2026: One UI 9 beta opens in India on S911BXXUAZZHL, a 3.42GB Android 17 build that still carries the August 5, 2026 patch.
8. September 8, 2026: Samsung publishes SMR-SEP-2026 for major flagship models.
9. September 9, 2026: Firmware listings show an S23 Ultra September candidate, S918BXXSAFZI1, on One UI 8.5.

That lag is the other half of the May story. Samsung’s security page already admits OS upgrades delay monthly patches. One UI 8.5 was a large one. The August S23 train arriving on August 31 is that warning in firmware form, and it is the same pattern that makes the S23 support clock after the May patch feel shorter than the original brochure.

A few owners have also described green or pink display lines after the 8.5-era window and the August package, with service desks pointing to a three-year screen policy instead of a free swap. That is not in Samsung’s SMR notes. It is the complaint that now rides along with every S23 build.

One UI 9 Beta Is Already in India

The May 2026 security update did not end the S23’s software life. It marked the turn into the last stretch. Firmware tracker posts on September 3 showed the One UI 9 beta live in India for the S23 series on S911BXXUAZZHL, with matching Ultra and Plus builds, at 3.42GB. The beta still used the August 5, 2026 security patch. Replies to that drop immediately reached for the green-line joke, and for the fact that India saw the beta before Korea, the UK, or the US.

Samsung’s September SMR is already on the public security page as of September 8. An S23 Ultra September candidate, S918BXXSAFZI1, was on listing sites a day later. That is a build sighting, not a finished global rollout. It is enough to show the monthly machine is still turning while the last OS is tested.

Check for both from Settings, Software update, Download and install. The May 2026 package remains the one that shut CVE-2026-0073. Every later S23 build is more of that security work, plus whatever bug-fix scraps Samsung tucks into the same zip, while One UI 9 tests the last OS those phones are still owed.

Frequently Asked Questions

What patch level closes CVE-2026-0073 on a Galaxy S23?

Google says security patch levels of 2026-05-01 or later address the May bulletin, including CVE-2026-0073. On Android 10 and later, a Google Play system update can also show a matching 2026-05-01 date string for the adbd Mainline component even before a full Samsung firmware zip arrives, so both the Samsung patch level and the Play system date are worth checking.

How many major OS upgrades did Samsung promise the Galaxy S23?

Samsung promised four major operating-system upgrades on top of the Android 13 software the phone shipped with, which is why Android 17 and One UI 9 complete the OS side of the bargain. Point releases such as One UI 8.5 are extra platform drops, not a fifth numbered Android generation, and they are the layer Samsung has already shown it can withhold once a series has used up its four OS steps.

When do Galaxy S23 security updates end?

Samsung’s current S23 support language is five years of security updates from the series, which launched in February 2023, so the security side runs through early 2028. After the last major OS upgrade, those remaining months are patch-only, with delivery still varying by region and sometimes slipping when a One UI upgrade is in the way.

Do May 2026 Galaxy S23 firmware names stay the same in every country?

No. The India May builds used the BXXSAFZE1 family (S911B, S916B, S918B), while US carrier units used a USQU prefix on the earlier One UI 8.5 drop, and Korea’s later August security zip used an NKSS code, S91xNKSS8FZH2. If the token in the middle of the build string matches the month’s letter code, the regional letters around it can still differ.

Can a PC install the Galaxy S23 update if the phone never sees it?

Samsung’s S23 support pages point owners to Smart Switch on a computer as well as the on-phone Software update menu, which is the practical fallback when an OTA is slow in one carrier bucket. Flashing unofficial archives is a separate risk and is not what those support pages recommend.

The May 2026 zip is still the one that shut the no-tap ADB hole. Later S23 builds only added more of that security work, while the September 3 beta tests the last OS Samsung still owes the line.