← Back to Cybersecurity Cybersecurity

Android's October 2026 update patches 25 vulnerabilities, including seven critical flaws

Google's October patch resolves seven flaws in Framework and 18 in System, including one remote denial-of-service bug that needs no user interaction, plus extra Pixel and Automotive fixes.

Cybersecurity ADS News Cybersecurity Desk · 6 min read

Google has released its October 2026 security updates for Android, resolving 25 vulnerabilities across the Framework and System components. The fixes arrive as the 2026-10-01 security patch level, and notably mark a change from recent years, when monthly Android updates were often split into two parts. According to SecurityWeek's coverage of the bulletin, the release includes seven flaws rated critical: one in Framework and six in System.

One remote DoS, six critical System bugs

The Framework-side critical is CVE-2026-58865, a denial-of-service bug that, per Google, requires neither additional execution privileges nor user interaction to exploit. It affects Android 14, 15, 16, 16 QPR2, and 17. On the System side, the six critical flaws are four elevation-of-privilege bugs (CVE-2026-55269, CVE-2026-55280, CVE-2026-58835, CVE-2026-58880) and two denial-of-service bugs (CVE-2026-49933, CVE-2026-55265). The most severe System flaw can lead to local elevation of privilege without additional execution privileges or user interaction — the sort of primitive that turns a compromised or sideloaded app into a foothold deeper in the operating system.

  • Critical System EoP: CVE-2026-55269, CVE-2026-55280, CVE-2026-58835, CVE-2026-58880
  • Critical System DoS: CVE-2026-49933, CVE-2026-55265
  • Critical Framework DoS: CVE-2026-58865 (remote, no user interaction)
  • High Kernel EoP: CVE-2026-56906, CVE-2026-56936
  • High information disclosure: CVE-2026-0198 (GDMC)

Pixel and Automotive OS get extra fixes

Google devices receive additional coverage in the Pixel Update Bulletin, published October 6. Devices at security patch level 2026-10-05 or later address all issues in both the Pixel and Android October bulletins. The Pixel-specific fixes include three critical bugs — a Bluetooth elevation-of-privilege (CVE-2026-55330), a GDMC elevation-of-privilege (CVE-2026-56952), and a GSA information disclosure (CVE-2026-55307) — plus a high-severity GDMC information disclosure (CVE-2026-0198). The Android Automotive OS update covers all 25 Android bugs plus five additional high-severity elevation-of-privilege flaws, which matters for connected cars that linger on old software. Google did not flag any of the patched vulnerabilities as actively exploited in the wild in these bulletins.

What this means for you

Update now if you can. The most severe flaws in this bulletin are a remote denial-of-service and local privilege escalations that need no user interaction — so a malicious or corrupted app, or a botched OTA, can push an attacker deeper into your system. Check Settings → Security → Security update. Pixel owners should look for a patch level of 2026-10-05 or later, and Android 14/15 users should treat this as a priority since both versions remain in scope for the critical fixes.

Sources: SecurityWeek: Android's October 2026 Updates Patch 25 Vulnerabilities (2026-10-07); eSecurity Planet: Google's October Android Update Patches 7 Critical Security Vulnerabilities (2026-10-07); Android Open Source Project: Android Security Bulletin, October 2026 (2026-10-01 patch level).

Corrections: Report an error at corrections@wireshaman.com.

More from the wire