Android Security Update September 2026 – Fix for Critical Flaws that Enable RCE Attacks
Google's September 2026 Android bulletin fixes over 30 critical flaws, including no-interaction system RCEs, a TIPC kernel RCE and a Qualcomm closed-source bug
Google's Android Security Bulletin for September 2026 (patch levels 2026-09-01 and 2026-09-05) fixes numerous critical System remote code execution flaws, including CVE-2026-28604, CVE-2026-28618, CVE-2026-28639, CVE-2026-28662, CVE-2026-49882, CVE-2026-49884, CVE-2026-49919 and CVE-2026-49921, none requiring user interaction or additional privileges. It also addresses critical kernel issues including a TIPC RCE (CVE-2026-52993) and elevation-of-privilege flaws in NFC and protected KVM, plus a critical Qualcomm closed-source component flaw (CVE-2026-25289). Affected versions span Android 14 through 17; the 2026-09-05 patch level extends coverage to Android TV and chipset components, with high-severity fixes for Arm Mali, PowerVR, MediaTek, Unisoc and Qualcomm components.
- Multiple critical System RCEs exploitable without user interaction across Android 14-17
- Kernel fixes include TIPC RCE (CVE-2026-52993) and EoP flaws in NFC and protected KVM
- Critical Framework issues include CVE-2026-28666, CVE-2026-55273 (EoP) and CVE-2026-49932 (DoS)
- 2026-09-05 patch level extends coverage to Android TV and chipset components
- High-severity fixes cover Arm Mali, PowerVR, MediaTek, Unisoc and Qualcomm components
- CVEs
- CVE-2026-28666CVE-2026-55273CVE-2026-49932CVE-2026-28604CVE-2026-28618CVE-2026-28639CVE-2026-28662CVE-2026-49882CVE-2026-49884CVE-2026-49919CVE-2026-49921CVE-2026-27280CVE-2026-28590CVE-2026-33636CVE-2026-45515CVE-2026-45531CVE-2026-49879CVE-2026-49918CVE-2026-49927CVE-2026-55277CVE-2026-55285CVE-2026-58820CVE-2026-58823CVE-2026-28653CVE-2026-49926CVE-2026-55256CVE-2026-31629CVE-2026-58846CVE-2026-58848CVE-2026-58941
- Products
- AndroidAndroid TV
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-27280 | DNG SDK versions 1.7.1 2471 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of… | 7.8 | <1% | PoC | |
| CVE-2026-49921 | Heap Buffer Overflow RCE in Android OS (September 2026 Security Update) | 9.8 group max | <1% | ||
| CVE-2026-31629 | Linux kernel: nfc: llcp: add missing return after LLCP_CLOSED checks | 8.8 | <1% | ||
| CVE-2026-33636 | LIBPNG: In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palette… | 7.6 | <1% | ||
| CVE-2026-49926 | — | — | — |
From the original article
4 min read at cybersecuritynews.com
Google released the Android Security Bulletin for September 2026, addressing several critical vulnerabilities that could let attackers execute code remotely on affected devices. The update, published on September 8, includes security patch levels dated 2026-09-01 and 2026-09-05. Android users should install the latest available update as soon as their device manufacturer releases it.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.