Google Patches 180 Vulnerabilities in September Android Update
Summary
Google’s September 2026 Android updates patch 180 vulnerabilities, including critical flaws that could enable remote code execution. Devices on patch level 2026-09-05 or newer receive the fixes.
Key points
- The updates address 180 vulnerabilities across two security patch levels: 95 fixes at 2026-09-01 and 85 at 2026-09-05.
- Google says the most severe issue is a critical System-component flaw that could allow remote code execution without user interaction or additional privileges.
- The System fixes include 23 critical-severity flaws, while the Framework fixes include three critical-severity bugs.
- The 2026-09-05 update covers Android kernel components and components from multiple hardware vendors, including Qualcomm and MediaTek.
- Jamf's Adam Boynton highlighted CVE-2026-28662, described as a Wi-Fi-related memory corruption flaw that could permit remote code execution without additional privileges or user interaction.
- Devices with security patch level 2026-09-05 or newer receive these fixes and those from the preceding Android patches.
Article Details
- Vulnerability Types
- Memory corruption
- Remote code execution
- Elevation of privilege
- Denial of service
- Severity
- Critical and high
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
CVE
People
Vendors
Products
AndroidAfter two ‘no security vulnerabilities’ bulletins in July and August, Google on Tuesday announced the release of patches for 180 vulnerabilities as part of the September 2026 Android security updates.Android Automotive OSThere are no specific security patches for Wear OS, Android XR, and Android Automotive OS this month.Android XRThere are no specific security patches for Wear OS, Android XR, and Android Automotive OS this month.Wear OSThere are no specific security patches for Wear OS, Android XR, and Android Automotive OS this month.