Google Patches Critical Android RCE Flaws Across Android 14–17

Google’s September 2026 Android Security Bulletin fixes more than 90 vulnerabilities affecting Android 14, 15, 16, 16 QPR2, and 17. The release rates 26 flaws as critical and 68 as high severity, including Android System remote-code-execution vulnerabilities that can be triggered without user interaction or additional execution privileges, depending on the affected CVE. It also addresses critical elevation-of-privilege and denial-of-service issues in the Framework and System, a critical Transparent Inter-Process Communication kernel-component RCE flaw, and defects in kernel, Android TV, and vendor components.

Google is distributing patch levels 2026-09-01 and 2026-09-05; devices at the latter level receive all applicable September fixes, including relevant kernel and vendor patches. Pixel and Samsung Galaxy devices are among the first receiving updates, while availability for other manufacturers may lag. Qualcomm separately released fixes for 14 high-severity vulnerabilities in software used by its mobile, wireless-connectivity, automotive, and computing platforms, which could expose confidential information or disrupt affected services. No active exploitation was reported at publication, but organizations should prioritize deployment of available Android and vendor updates.