Android October 2026 update fixes 25 flaws, seven of them critical

Google has released its October 2026 Android security updates, fixing 25 vulnerabilities in the operating system's Framework and System components, seven of which are rated critical. According to the Android Security Bulletin published on October 5, the most severe issue is a critical flaw in the System component that "could lead to local escalation of privilege with no additional execution privileges needed," without any user interaction. The fixes ship under a single 2026-10-01 patch level, which SecurityWeek notes is a departure from recent years when monthly updates were split into two parts.

What happened

The bulletin covers 7 Framework and 18 System vulnerabilities, SecurityWeek reported. In the Framework component, Google fixed two denial-of-service and five elevation-of-privilege bugs. The System fixes include eight elevation-of-privilege flaws, five denial-of-service issues, one remote code execution bug and four information disclosure flaws.

The critical System flaws are CVE-2026-55269, CVE-2026-55280, CVE-2026-58835 and CVE-2026-58880, all elevation-of-privilege bugs, along with the denial-of-service issues CVE-2026-49933 and CVE-2026-55265. The critical Framework flaw, CVE-2026-58865, can cause a remote denial of service, according to the bulletin.

Technical details

Google has not published technical details for the vulnerabilities, as is usual while patches roll out. The bulletin does not mention any of the issues being exploited in the wild, and SecurityWeek likewise reports no indication of active exploitation.

Three further issues were fixed through Google Play system updates: CVE-2026-58859 in Telephony core and CVE-2026-45524 and CVE-2026-49878 in the WiFi component. These reach supported devices through Google Play rather than a full firmware update.

Google's separate Pixel bulletin addresses six vulnerabilities that can lead to privilege escalation or information disclosure. Three of them are critical and affect the Bluetooth, GDMC and GSA components, SecurityWeek reported. Android Automotive OS receives all of the October Android fixes plus five additional high-severity privilege escalation bugs.

Who is affected

All Android devices below the 2026-10-01 patch level are affected. Pixel phones receive updates directly from Google, while devices from Samsung, Xiaomi, Oppo and other manufacturers depend on each vendor's own release schedule, so the update may arrive days or weeks later.

What to do

Users should check Settings for a system update and install the October patch as soon as it is available, then confirm that the security patch level shows 2026-10-01 or later. Google Play system updates should also be kept current. Organizations managing Android fleets can use their mobile device management tools to enforce a minimum patch level and flag devices that no longer receive security updates.