Loading story…
Google released its October 2026 Android security bulletin on October 5, addressing at least 25 vulnerabilities, including seven rated critical. The fixes cover local privilege escalation in the System component, remotely triggerable denial of service in the Framework, and remote code execution in Wi-Fi. Listed affected versions include Android 14, 15, 16, 16-QPR2, and 17. Google Play system updates dated October 1 also address vulnerabilities in Telephonycore and Wi-Fi. Google did not report active exploitation of the vulnerabilities.
The Canadian Centre for Cyber Security and Guyana National CIRT urged users and administrators to review the bulletin and apply applicable updates as they become available. Samsung separately announced October updates covering nine critical, 33 high-severity, and three medium-severity vulnerabilities, with device delivery potentially taking days or weeks. Organizations should prioritize affected Android devices, verify both vendor security patches and Google Play system updates, and track devices awaiting rollout.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-1003, encouraging users and administrators to review the October Android security bulletin and apply necessary updates as they become available.
Android published its October security bulletin on October 5, 2026. Google's corresponding updates address at least 25 vulnerabilities, including seven critical issues involving System privilege escalation, remotely triggerable Framework denial of service, and Wi-Fi remote code execution; Google reported no active exploitation.
Pixel devices received fixes for six additional privilege-escalation or information-disclosure vulnerabilities, including three critical flaws affecting Bluetooth, GDMC, and GSA. Android Automotive OS also received fixes for five additional high-severity privilege-escalation vulnerabilities alongside the standard Android fixes.
The Guyana National CIRT issued a notice directing users and administrators to the October Android security bulletin and recommending that they review and apply applicable updates. The notice also references the Canadian Cyber Centre's monthly rollup advisory.
Samsung announced October 2026 security updates incorporating Google's patches and additional fixes, covering nine critical, 33 high-severity, and three medium-severity vulnerabilities. Delivery to end-user devices could take days or weeks.
Google released Play system updates addressing a Telephonycore denial-of-service vulnerability and two Wi-Fi vulnerabilities allowing sandbox escape and privilege escalation or remote code execution. The updates carry an October 1, 2026 patch level, which does not establish their release date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalwarebytes.com
Open sourcesecurityweek.com
Open sourceheise.de
Open sourcecyber.gc.ca
Open sourceheise.de
Open sourcecirt.gy
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google’s September 2026 Android Security Bulletin fixes more than 90 vulnerabilities affecting Android 14, 15, 16, 16 QPR2, and 17. The release rates 26 flaws as **critical** and 68 as high severity, including Android System remote-code-execution vulnerabilities that can be triggered without user interaction or additional execution privileges, depending on the affected CVE. It also addresses critical elevation-of-privilege and denial-of-service issues in the Framework and System, a critical Transparent Inter-Process Communication kernel-component RCE flaw, and defects in kernel, Android TV, and vendor components. Google is distributing patch levels `2026-09-01` and `2026-09-05`; devices at the latter level receive all applicable September fixes, including relevant kernel and vendor patches. Pixel and Samsung Galaxy devices are among the first receiving updates, while availability for other manufacturers may lag. Qualcomm separately released fixes for 14 high-severity vulnerabilities in software used by its mobile, wireless-connectivity, automotive, and computing platforms, which could expose confidential information or disrupt affected services. No active exploitation was reported at publication, but organizations should prioritize deployment of available Android and vendor updates.
Sep 9, 2026
Samsung’s October 2026 security update addresses nine critical, 33 high-severity and three moderate-severity Android vulnerabilities, alongside Samsung-specific flaws. Critical Android System vulnerabilities could allow local privilege escalation, while an Android Framework flaw could enable remote denial of service without user interaction. Samsung-specific fixes address potential arbitrary code execution in media, WSM, text-to-speech and HEIF image-processing components. The Dutch NCSC also warned of vulnerabilities, including **CVE-2026-45524**, affecting Android 14 through 17 and Samsung Mobile devices, with potential consequences including unauthorized access, device takeover, data exposure or alteration, and service disruption, depending on the flaw. Google’s bulletin did not indicate active exploitation, and the NCSC reported neither evidence of exploitation nor known publicly available exploit code, rating exploitation likelihood as medium. Google and Samsung have released fixes, and the NCSC recommends applying them promptly. A separate Samsung Internet update addresses **CVE-2026-21132**, a high-severity script-injection vulnerability affecting versions before **30.0.5.24**. Enterprise administrators should verify both device security patch levels and Samsung Internet versions rather than assume a major operating-system upgrade includes all applicable fixes.
Oct 8, 2026
Google released the December 2025 Android Security Bulletin, patching 107 vulnerabilities, including a critical remote Denial of Service (DoS) flaw (CVE-2025-48631) in the Android Framework and two zero-day vulnerabilities (CVE-2025-48633 and CVE-2025-48572) that are reportedly under active exploitation. The zero-days allow for information disclosure and elevation of privilege, affecting Android versions 13 through 16, and are believed to be targeted in limited attacks. The DoS vulnerability enables remote attackers to crash or disable devices without requiring user interaction or additional execution privileges. The update is distributed in two patch levels (2025-12-01 and 2025-12-05), covering both core Android components and vendor-specific issues. Google’s disclosure highlights the ongoing threat posed by actively exploited vulnerabilities in the Android ecosystem and underscores the importance of timely patching by device manufacturers and users. The December update represents one of the largest patch releases of the year, following a period of irregular vulnerability reporting from Google.
Jun 29, 2026