Android October 2026 updates patch 25 flaws, no exploitation reported

Google's October 2026 Android updates fix 25 flaws, including seven critical bugs, with no known exploitation; many devices get patches late.

Canada's Cyber Centre published advisory AV26-1003 on October 6, 2026, pointing to Android's October 5, 2026 security bulletin and urging users and administrators to review it and install updates; the notice names no CVE identifiers and gives no exploitation status. SecurityWeek reports that Google's October 2026 updates, delivered as the 2026-10-01 patch level, fix 25 vulnerabilities—seven in Framework and 18 in System—including seven critical-severity bugs. The most severe System issue can allow local privilege escalation with no additional privileges and no user interaction; System fixes also include eight elevation-of-privilege issues, five denial-of-service bugs, one remote code execution flaw, and four information disclosures. Pixel devices and Android Automotive OS received additional high- and critical-severity patches, and Google does not say any of the issues are being exploited. Malwarebytes says the October updates cover Android 14, 15, 16, 16-qpr2, and 17, that several critical flaws can be exploited without user interaction, and that about four in ten devices remain on Android 12 or earlier, with vendor testing delaying patches and Samsung placing some Galaxy S22 and Galaxy A models on a quarterly rather than monthly schedule. The sources do not conflict on exploitation and none name CVE identifiers; they differ in specificity, with the Cyber Centre citing an October 5 bulletin and SecurityWeek citing the 2026-10-01 patch level.

• Canadian Centre for Cyber Security issued advisory AV26-1003 on October 6, 2026, pointing to Android's October 5, 2026 security bulletin and naming no CVEs or exploitation status.
• SecurityWeek: the 2026-10-01 patch level fixes 25 vulnerabilities—seven in Framework and 18 in System—including seven critical-severity bugs.
• The most severe System issue allows local privilege escalation with no extra privileges and no user interaction; System fixes also cover eight elevation-of-privilege issues, five denial-of-service bugs, one remote code execution flaw, and…
• Pixel devices and Android Automotive OS received additional high- and critical-severity patches; Google does not report any of these flaws exploited in the wild.
• Malwarebytes: October updates cover Android 14, 15, 16, 16-qpr2, and 17, and several critical flaws can be exploited without user interaction; no CVE identifiers are named.
• About four in ten devices were still on Android 12 or earlier; Samsung updates some Galaxy S22 and Galaxy A models quarterly rather than monthly.