I bought a ‘Samsung S26’ on Temu. This is what was actually inside.

I bought a phone on Temu that was sold as a Samsung S26: 8 GB of RAM, 128 GB of storage, a modern look, and a price that was, naturally, a little too good to be true. When I turned it on, Android simply called it S26_Ultra.

But I wanted to know what I had actually bought. Not because I specifically wanted to break a phone or turn it into a hobby project, but because I do not want to use an unknown Android installation for my accounts, photos and messages. My plan was to find out what was inside first, then see whether I could turn it into the safest Android installation possible.

The first disappointment: the name means nothing

With phones like this, you cannot blindly trust what Settings tells you. A seller can make software show any name, Android version, storage capacity, and sometimes even RAM amount. So I looked beyond Android and checked the information exposed by the bootloader through ADB and Fastboot.

That revealed a very different phone. The bootloader calls the board k50sv1_64_bsp. The chip is a MediaTek MT6755 and the kernel is Linux 3.18.119. That is Helio P10-era hardware from roughly 2016: not a new Samsung, and not hardware designed for a current Android release.

Storage was another red flag. The partition layout left about 55.4 GB for user data. That makes sense for a 64 GB-class storage chip once Android and the other partitions take their share. It does not make sense for the advertised 128 GB. The phone also returned conflicting RAM and Android values, so I cannot independently confirm the promised 8 GB of RAM. That alone is enough reason not to trust the specifications.

Why I did not want to keep the original software

I cannot prove which app or process on the original installation might be watching what. I am not going to claim that without evidence. What I do know is that the software lies about the phone's identity, the hardware is far older than the advert suggests, and the vendor software comes from a source I cannot verify. For me, that makes “just factory-reset it” insufficient. A reset removes my data; it does not replace the old kernel, modem software or manufacturer components.

So I first read everything that was safe to inspect: the chip, kernel, partitions and bootloader state. Only then did we unlock the bootloader and wipe the phone. That has a downside: an unlocked bootloader makes a phone less secure because the normal startup verification is missing. But without it, I could not even try to make the Android installation as safe as possible.

Android 17

My first attempt was an official Android 17 AOSP GSI: no Google apps, no extra clutter, just AOSP. The installation itself completed, but the phone never reached the welcome screen. It kept restarting in a boot loop.

That was frustrating, but it made one thing very clear: putting a new Android system on top is not the same as making a new phone. Android 17 is modern, but the layer underneath is still that old MediaTek software.

Android 12

Next, we tried an Android 12.1 VNDK-lite GSI. VNDK-lite sounds complicated, but the basic idea is simple: it is an Android build with additional compatibility work for old and unusual manufacturer software. This one did boot.

After a clean reset, almost everything appeared to work. The screen, controls, Wi-Fi, network connection and ordinary Android functions did what they should. That was honestly a pleasant surprise. The one clear exception was the camera. No photos, no usable camera app, nothing. That is not a small detail on a phone.

This was not one incorrect setting. The camera needs its own drivers and manufacturer-specific software layer. Those old camera components do not communicate properly with a generic Android installation. Installing another camera app will not fix that.

Because I also wanted to know whether it could work as an ordinary phone with apps, I then flashed the secure Google edition from the same Android 12.1 VNDK-lite family. That brings back the Play Store and Google Play Services. It is convenient, but it is also a different choice from my original aim of reducing tracking as much as possible. Once you use Google, you bring Google services and telemetry back in too.

Why I cannot simply update the kernel

The obvious question is: if Android 12 mostly works, why not put a newer kernel underneath it and try Android 17 again? The honest answer is that this is not an update button.

The kernel is the layer that talks to the physical hardware. It has to know exactly how the display, touchscreen, audio, storage, modem, sensors and camera are connected. That requires drivers, configuration and closed MediaTek components. Replace the kernel and all of that has to be made to fit again.

A real modern port would need the source code and configuration for this exact board, a modern device tree and all the proprietary blobs. None of that is publicly available for this obscure device. You would be starting a major development project with old hardware, no official documentation, and parts you cannot replace or properly test. That is why Android 17 boot-loops and Android 12 works only because of a compatibility layer.

In other words: the Android version number may look newer, but the important layer underneath remains old. A new launcher or a new Play Store does not make Linux 3.18 safer. It also gives no guarantee that the camera, calling, Bluetooth or something else will keep working after another update.

My conclusion

I think it is impressive that Android 12 eventually runs on it at all. For someone who only wants to experiment and does not mind losing the camera, it could even be a fun project. But that is not what I ordered.

My goal was the safest Android installation possible. I only partly achieved it: the preinstalled Android was replaced, but the kernel and vendor software remain old, the bootloader remains unlocked and the camera does not work. This Android 12 build is therefore an improvement over the original software, not a secure modern phone.

I ordered a modern Samsung S26 with 8 GB of RAM and 128 GB of storage, not an old MediaTek phone that calls itself S26_Ultra in Android and becomes only mostly usable after hours of technical work. That is why I am returning it. A phone that only works more or less after a major technical workaround—and then without a working camera—is not what the advert promised.