Android’s October 2026 Updates Patch 25 Vulnerabilities

Summary

Google has released its October 2026 Android security updates, addressing a total of 25 vulnerabilities across the Framework and System components. The patches include seven critical-severity bugs, with the most severe being a privilege escalation flaw in the System component that requires no additional execution privileges and user interaction. Additionally, Pixel devices and Android Automotive OS received specific fixes for other vulnerabilities.

Full text

Google this week announced the rollout of fresh Android security updates that resolve 25 vulnerabilities in the Framework and System components. The fresh release arrives on devices as the 2026-10-01 security patch level and marks a change from the updates released over the past several years, which have been split into two parts. Android’s October 2026 patches resolve seven flaws in Framework and 18 in System, including a total of seven critical-severity bugs (one in Framework and six in System). “The most severe of these issues is a critical security vulnerability in the System component that could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation,” Google notes in its advisory. Of the issues resolved in Framework, two can lead to denial-of-service (DoS) and five to elevation of privilege (EoP). In System, Google resolved eight EoP vulnerabilities, five DoS bugs, one remote code execution (RCE) flaw, and four information disclosure issues. The advisory also mentions three security defects addressed via Google Play system updates, including one in Telephonycore and two in WiFi.Advertisement. Scroll to continue reading. In addition to the Android patches, Pixel devices received fixes for six vulnerabilities that could lead to EoP and information disclosure, including three critical-severity issues affecting the Bluetooth, GDMC, and GSA components. The Android Automotive OS update contains fixes for all the bugs resolved with the Android October 2026 updates and for five other high-severity bugs leading to EoP. Google makes no mention of any of these vulnerabilities being exploited in the wild. However, users are advised to update their devices as soon as possible. Related: Android’s September 2026 Updates Patch 180 Vulnerabilities Related: Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports Related: FBI Blames Contractor’s Missed Patch for ShinyHunters Breach Related: Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws250,000 Impacted by Data Breaches at New Jersey, Texas Healthcare FirmsExploitation Hits Rejetto HFS Vulnerability Discovered by AI Alleged ShinyHunters Leader Arrested in JordanFortra Patches Critical Vulnerabilities in BoKSIn Rare Move, Alleged Iranian State Hacker Extradited to USWarlock Expands SharePoint Exploitation in Critical Infrastructure AttacksExploited Fortinet FortiMail Zero-Day Calls for Urgent Action Latest News Atlassian Patches Critical Vulnerability Affecting 8 ProductsPersonal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court SystemFBI Blames Contractor’s Missed Patch for ShinyHunters BreachFBI Arrests ‘Most Wanted’ Developer of Ploutus ATM MalwareApple to Tighten Full Disk Access Controls in macOS Amid AI RisksCybersecurity M&A Roundup: 39 Deals Announced in September 2026Long-Running NPM Malware Campaign Accumulates 40,000 Downloads8.8 Million Impacted by Data Breach at Denmark’s Central Person Register Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Securing AI Agents, MCPs, and AI Automations October 7, 2026 Learn how to address potential risks and not restrict AI adoption in your organization. See what a centralized AI gateway is and how it works in practice. Register Virtual Event: Zero Trust & Identity Strategies Summit 2026 October 14, 2026 Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction. Register People on the MoveChip Wentz has been appointed as SVP & CISO at Keurig Dr Pepper Inc.Lumen Technologies has named Kim Keever as CSO.Quantum Secure Encryption Corp. has appointed Joseph Hall as CIO.More People On The MoveExpert Insights AI Has Changed Attack Speed, Not Security Fundamentals As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals. (Joshua Goldfarb) Four Cyber Threats Harboring Big Plans for the Future - AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations. (Steve Durbin) Begin at the End: How to Enable Agentic Remediation Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael) “We Think the Security Control Is Working” Is No Longer Good Enough Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar) This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) Flipboard Reddit Whatsapp Whatsapp Email

Entities