- Google’s October Android updates resolve 25 vulnerabilities in Framework and System.
- The most severe issue is a critical System flaw that could enable local privilege escalation without user interaction or additional execution privileges.
- Patch levels of 2026-10-01 or later address all issues in the bulletin.
Google has announced Android security updates that resolve 25 vulnerabilities in the Framework and System components, including seven critical-severity bugs.
The most severe issue is a critical System vulnerability that could allow local privilege escalation without additional execution privileges or user interaction. Google said Android security patch levels of 2026-10-01 or later address all the issues.
The bulletin covers Android’s core Framework and System components. It also describes fixes delivered through Google Play system updates, Pixel devices and Android Automotive OS.
On this page
Android fixes cover seven Framework flaws and 18 System flaws
Google said the Framework fixes include two denial-of-service flaws and five elevation-of-privilege flaws. System fixes include eight elevation-of-privilege flaws, five denial-of-service flaws, one remote-code-execution flaw and four information-disclosure flaws.
The advisory also identifies three defects addressed through Google Play system updates: one in Telephonycore and two in WiFi.
Pixel and Automotive OS receive additional October fixes
Google said Pixel devices received fixes for six vulnerabilities involving elevation of privilege and information disclosure. Three critical-severity issues affect the Bluetooth, GDMC and GSA components.
The Android Automotive OS update includes fixes for all bugs resolved by the October Android updates, along with five additional high-severity elevation-of-privilege bugs.
Samsung’s October release includes up to 83 vulnerability fixes across Google Android components and Galaxy hardware. It also includes 27 Samsung Vulnerabilities and Exposures and four high-risk Samsung Semiconductor fixes.
Google said it notified Android partners of all the issues at least a month before publishing the bulletin. Supported Pixel devices will receive an update to the 2026-10-05 patch level.
Google encourages Android users to update to the latest version where possible and asks Pixel customers to accept the available security updates.
What to do now
- Update to the latest version of Android where possible.
FAQ
What did Google fix in the October Android update?
Google said the update resolves 25 vulnerabilities in the Framework and System components, including seven critical-severity bugs.
What is the most severe October Android vulnerability?
Google describes it as a critical System vulnerability that could lead to local privilege escalation without additional execution privileges or user interaction.
Which Android patch level fixes the October vulnerabilities?
Android security patch levels of 2026-10-01 or later address all the issues in the bulletin.
Are Pixel devices included in the Android October updates?
Yes. Pixel devices received fixes for six vulnerabilities, according to Google.
What other Android products received October fixes?
The Android Automotive OS update includes the October Android fixes and five additional high-severity elevation-of-privilege fixes. Google Play system updates address one Telephonycore defect and two WiFi defects.
Sources
- Android Security Bulletin, October 2026 | Android Open Source Project, GooglePrimary
- Pixel Update Bulletin, October 2026 | Security | Android Open Source Project, GooglePrimary
- Android Security Bulletin, November 2026 | Android Open Source Project, GooglePrimary
- Android’s October 2026 Updates Patch 25 Vulnerabilities, SecurityWeek
- Android’s November 2026 Updates Patch Over 200 Vulnerabilities, SecurityWeek
- Samsung Details Big October 2026 Security Update Targeting Dozens of Critical Galaxy Vulnerabilities, Samsung
How we checked this story
| Claim | Source | Status |
|---|---|---|
| Google’s October 2026 Android updates resolve 25 vulnerabilities in the Framework and System components. | Google, via SecurityWeek | Attributed |
| Google said the updates arrive on devices as the 2026-10-01 security patch level. | Google, via SecurityWeek | Attributed |
| Google said the October updates resolve seven Framework flaws and 18 System flaws, including seven critical-severity bugs. | Google, via SecurityWeek | Attributed |
| Google says the most severe issue is a critical System vulnerability enabling local privilege escalation without additional execution privileges or user interaction. | Confirmed | |
| Google said the Framework fixes include two denial-of-service flaws and five elevation-of-privilege flaws. | Google, via SecurityWeek | Attributed |
| Google said the System fixes include eight elevation-of-privilege flaws, five denial-of-service flaws, one remote-code-execution flaw, and four information-disclosure flaws. | Google, via SecurityWeek | Attributed |
| Google also addressed three defects through Google Play system updates, including one in Telephonycore and two in WiFi. | Google, via SecurityWeek | Attributed |
| Google said pixel devices received fixes for six vulnerabilities involving elevation of privilege and information disclosure. | Google, via SecurityWeek | Attributed |
| Google said three critical Pixel vulnerabilities affect the Bluetooth, GDMC, and GSA components. | Google, via SecurityWeek | Attributed |
| Google said the Android Automotive OS update fixes all bugs in the October Android updates and five additional high-severity elevation-of-privilege bugs. | Google, via SecurityWeek | Attributed |
| Android security patch levels of 2026-10-01 or later address all issues in the October bulletin. | Confirmed | |
| Google notified Android partners of all issues at least one month before publishing the bulletin. | Confirmed | |
| Google encourages Pixel customers to accept the available security updates. | Confirmed | |
| Samsung’s October release includes up to 83 vulnerability fixes across Google Android components and Galaxy hardware. | Samsung | Attributed |
| Samsung’s release includes 27 Samsung Vulnerabilities and Exposures and four high-risk Samsung Semiconductor fixes. | Samsung | Attributed |
| Samsung says its fixes apply to devices running Android 14 through Android 17. | Samsung | Attributed |
| Google said the 2026-11-01 patch level resolves 119 security defects across Android runtime, Framework, and System. | Google, via SecurityWeek | Attributed |
| Google said framework received fixes for 65 flaws, while System received fixes for 53. | Google, via SecurityWeek | Attributed |
| Google identifies CVE-2026-58868 as the most severe November weakness, a critical Framework flaw enabling remote code execution without additional privileges or user interaction. | Google, via SecurityWeek | Attributed |
| Google addressed critical remote-code-execution, elevation-of-privilege, and denial-of-service vulnerabilities in System. | Google, via SecurityWeek | Attributed |
| Google patched 17 November flaws early through Google Play system updates. | Google, via SecurityWeek | Attributed |
| Google said the 2026-11-05 patch level fixes 97 vulnerabilities in Kernel, Arm, Imagination Technologies, MediaTek, Unisoc, and Qualcomm components. | Google, via SecurityWeek | Attributed |
| Android security patch levels of 2026-11-05 or later address all November issues. | Confirmed | |
| Google says the most severe November issue is a critical Framework vulnerability that could enable remote code execution without additional privileges or user interaction. | Confirmed | |
| Google will release corresponding AOSP source-code patches within 48 hours after initially publishing the November bulletin. | Confirmed | |
| Google notified Android partners of all November issues at least one month before publishing the bulletin. | Confirmed |
Could not verify
- Whether any October 2026 Android vulnerability was exploited in the wild is not established
- Whether the October bulletin’s vulnerabilities received CVE assignments is not established
- How many Android devices received the updates is not established
- Whether the Samsung and Google vulnerabilities are linked beyond inclusion in the same release is not established
Related stories
Vulns & PatchesCitrix discloses critical NetScaler zero-days after exploitation reports
Vulns & PatchesPTC Windchill and FlexPLM flaw could enable remote code execution
Vulns & PatchesN-able takes hosted N-central offline after researcher discloses flaws