Google published its October 2026 Android Security Bulletin on October 5. It fixes 25 vulnerabilities across the Android Framework and System components, and seven of them are rated critical. The bulletin's summary names the most severe issue as a critical elevation-of-privilege flaw in System that allows local escalation with no additional execution privileges and no user interaction. Google updated the bulletin to version 1.1 on October 8 to add Android Open Source Project (AOSP) links.

All of the fixes come under one security patch level, 2026-10-01. SecurityWeek notes that this departs from recent years, when Android's monthly updates were split into two patch levels. The bulletin states that devices at patch level 2026-10-01 or later address all of the issues it lists.

What was fixed

The bulletin splits the 25 CVEs into 7 in Framework and 18 in System, with one critical flaw in Framework and six in System. By type, the Framework fixes are five elevation-of-privilege (EoP) bugs and two denial-of-service (DoS) bugs. The System fixes cover 8 EoP bugs, 5 DoS bugs, 1 remote code execution (RCE) bug and 4 information disclosure bugs. Every entry not rated critical is rated high.

The critical and notable entries, grouped by impact:

  1. Four critical EoP flaws in System: CVE-2026-55269, CVE-2026-55280, CVE-2026-58835 and CVE-2026-58880. For all four, the bulletin lists Android 16, 16-qpr2 and 17 as the updated AOSP versions. NVD describes CVE-2026-55269 as a possible memory safety issue in FilterCapturedPacket of snoop_logger.cc, due to improper input validation, that could lead to local escalation of privilege with no additional execution privileges needed and no user interaction. The CVSS 3.1 base score on its NVD record, supplied by CISA's ADP enrichment rather than calculated by NVD itself, is 7.8 (High). Google rates it critical on its own severity scale.
  2. A critical remote DoS flaw in Framework: CVE-2026-58865, with updated AOSP versions 14, 15, 16, 16-qpr2 and 17. According to NVD, a missing bounds check in multiple functions of PduParser.java could cause a persistent denial of service that can be triggered remotely, with no additional execution privileges and no user interaction needed. The CVSS 3.1 base score on its NVD record, again from CISA-ADP, is 7.5 (High).
  3. Two critical DoS flaws in System: CVE-2026-49933, listed for Android 16, 16-qpr2 and 17, and CVE-2026-55265, listed for Android 14 through 17.
  4. A high-severity RCE flaw in System: CVE-2026-49878, listed for Android 14 through 17. It is the only remote code execution bug in the bulletin and is also one of the WiFi fixes delivered through Google Play system updates (see below).

Google's critical ratings and the High CVSS scores come from different scoring systems. The bulletin states that its severity rating assumes platform and service mitigations are disabled for development purposes or have been bypassed.

Google Play system updates

The bulletin lists three issues in Project Mainline components that are also fixed through Google Play system updates. All three also appear in the System table:

  • CVE-2026-58859 in Telephony core (a high-severity DoS flaw, Android 17)
  • CVE-2026-45524 in WiFi (a high-severity information disclosure flaw, Android 17)
  • CVE-2026-49878 in WiFi (the RCE flaw above)

Pixel and Automotive

Pixel phones get six additional fixes for elevation-of-privilege and information disclosure flaws, according to SecurityWeek, which reports that three of them are critical and that they affect Bluetooth, GDMC and GSA components. SecurityWeek also reports that Android Automotive OS receives all of the October platform fixes plus five other bugs, all high-severity EoP flaws.

Exploitation status

The bulletin does not flag any of the October fixes as exploited in the wild. NVD published the records for CVE-2026-55269 and CVE-2026-58865 on October 5, the same day as the bulletin. As of October 19, none of the seven critical CVEs or the RCE flaw appears in CISA's Known Exploited Vulnerabilities catalog.

What It Means for Defenders

  • Raise the minimum patch level to 2026-10-01 in mobile device management and compliance policies, and prioritize devices on the Android versions listed for the critical System flaws above.
  • Verify Google Play system updates separately from vendor firmware, since the Mainline fixes listed above arrive through that channel.
  • Push the October Pixel update to managed Pixel devices to pick up the Pixel-specific fixes alongside the platform patches.
  • Ask Android Automotive OS suppliers for their delivery schedule for the October fixes.
  • Record non-Pixel models still below 2026-10-01 and treat them as documented exceptions until their manufacturers ship the update.

Sources