Samsung nukes third-party fonts in march patch, cites security hole
One UI 8.5 hit devices last week and immediately broke every custom font sideloaded through zFont 3, FontFix or similar work-arounds. What looks like a routine bug is, in fact, a deliberate burial: Samsung quietly patched CVE-2026-20989, a local-privilege flaw that let unverified font packages execute system-level code. The collateral damage is a million tweaked interfaces reverting to Samsung Sans overnight.
The exploit samsung never mentioned
Documents filed to the Android Security Bulletin list the vulnerability as “moderate,” but the patch closes a decade-old loophole. Third-party font tools used a Samsung-internal APK flag—never meant for public consumption—to inject TTF files straight into /system/fonts. That same flag could be weaponised to drop a payload alongside a pretty typeface. Samsung’s fix removes the flag entirely; font injectors now hit a brick wall.
Reddit threads lit up within hours. “Opened Reddit, saw my phone vomiting Comic Sans back at me,” wrote u/htetznaing, developer of zFont 3. His post confirming One UI 8.5 incompatibility has 4.2 k up-votes and counting. Samsung’s official changelog calls the update “stability improvements,” omitting any reference to fonts or CVE numbers.
Only galaxy store fonts survive
Monetisation follows security. Fonts bought through the Galaxy Store—where Samsung clips 30 %—still install without hiccup. The catalog, however, carries fewer than 200 families; zFont’s repo surpassed 8 000. Users who paid for premium icon-and-font bundles now own unusable files unless they root, a step that trips Knox’s e-fuse and voids warranties.
Android’s open-source ethos has long been Samsung’s marketing cudgel against Apple. Killing off non-certified typography chips away at that narrative, replacing it with a walled garden the width of a Korean storefront. Power users call it “the Appleification of Galaxy.”
No rollback, no apology
Samsung Europe told TechCurrent the change is “permanent,” recommending Galaxy Store fonts or the system default. Asked why the bulletin lacked upfront warning, the spokesperson blamed “standard disclosure policy,” a phrase that translates to: we patch first, explain later, maybe.
The next firmware, One UI 8.6, enters beta in April. Developers already probing the leaked build confirm the font flag is still missing. For the typography-obsessed, the choice is stark: swallow Samsung’s curated shelf, stay on the February patch and miss security fixes, or migrate to a Pixel where Magisk still reigns.
Customisation used to be Samsung’s flex. This week it became a hostage situation—pay inside the walls or stare at Roboto for the next three years.