Android Security Update September 2026 – Fix for Critical Flaws that Enable RCE Attacks

Google released the Android Security Bulletin for September 2026, addressing several critical vulnerabilities that could let attackers execute code remotely on affected devices.

The update, published on September 8, includes security patch levels dated 2026-09-01 and 2026-09-05. Android users should install the latest available update as soon as their device manufacturer releases it.

The most serious flaws affect the Android System component. Google said these critical vulnerabilities could lead to remote code execution, or RCE, without requiring additional execution privileges or user interaction.

In a successful attack, a threat actor may be able to run malicious code on a vulnerable device remotely, potentially before the user is aware of any compromise.

Android Security Update September 2026

The September update fixed several critical System RCE vulnerabilities, including CVE-2026-28604, CVE-2026-28618, CVE-2026-28639, CVE-2026-28662, CVE-2026-49882, CVE-2026-49884, CVE-2026-49919, and CVE-2026-49921. The flaws affect multiple Android releases, including Android 14, Android 15, Android 16, Android 16 QPR2, and Android 17.

The bulletin also includes CVE-2026-52993, a critical remote code execution vulnerability in a kernel component associated with Transparent Inter-Process Communication.

Kernel-level vulnerabilities matter because the kernel manages core system functions and hardware access. Exploitation could give an attacker a powerful foothold inside the operating System.

Google also fixed critical elevation-of-privilege flaws in System and Framework components that could allow attackers with limited access to gain higher permissions.

Attackers may combine these issues with other vulnerabilities to escape app sandboxes, access protected data, turn off security controls, or take broader control of the device.

Critical Framework issues include CVE-2026-28666 and CVE-2026-55273, both of which could allow remote privilege escalation without user interaction.

Google also fixed CVE-2026-49932, a critical denial-of-service issue in Framework that could make an affected device or service unavailable. The 2026-09-05 patch level expands coverage to Android TV, the Linux kernel, chipset components, and vendor-specific drivers.

Kernel fixes include critical elevation-of-privilege vulnerabilities in NFC and Protected Kernel-Based Virtual Machine components, tracked as CVE-2026-31629, CVE-2026-58846, CVE-2026-58848, and CVE-2026-58941.

The update further contains high-severity fixes affecting Arm Mali GPUs, Imagination Technologies PowerVR GPUs, MediaTek modem and multimedia components, Unisoc modem components, and Qualcomm software. One Qualcomm closed-source component vulnerability, CVE-2026-25289, is rated critical.

Google stated that Google Play Protect continues to monitor for potentially harmful applications and is enabled by default on devices that include Google Mobile Services. However, platform protections should not replace patching.

Users who install apps from third-party sources face additional risk and should be particularly careful to keep Android and Google Play System updates current.

To verify protection, open Settings, go to Security and privacy, and check the Android security update level. Devices running the 2026-09-05 patch level or later include all applicable fixes in the September bulletin.

Devices with the 2026-09-01 level receive the core Android framework, runtime, System, and Project Mainline fixes. At the same time, the later patch level also includes applicable kernel, TV, and vendor component updates.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Android Security Update September 2026 – Fix for Critical Flaws that Enable RCE Attacks appeared first on Cyber Security News.