Android’s September 2026 Updates Patch 180 Vulnerabilities
Google released a substantial Android security update addressing 180 vulnerabilities, including a critical remote code execution flaw. This update, released on September 2026, focuses heavily on the System component and includes fixes for a wide range of issues across various Android components, highlighting the ongoing need for timely updates to mitigate potential risks.
Google announced the release of a significant Android security update, containing patches for 180 vulnerabilities as part of the September 2026 Android security updates. The update is delivered in two parts, with the first arriving on September 2026 and addressing 95 bugs across Android runtime, Framework, System, Setup Wizard, and multiple Project Mainline components via Google Play system updates. A critical security vulnerability within the System component presents a remote code execution risk, requiring no user interaction or additional privileges to exploit.
The update also resolves 56 security defects within the System component, including 23 critical-severity flaws that could lead to remote code execution (RCE), elevation of privilege (EoP), and denial-of-service (DoS). Furthermore, 37 vulnerabilities exist within the Framework component, including three critical-severity bugs and one flaw in Android runtime. The second part of the update, released on September 2026-05, contains fixes for 85 security defects across Android’s kernel and its components, as well as TV, Arm, Imagination Technologies, MediaTek, Tsingteng Micro, Unisoc, and Qualcomm components.
“Android’s September Bulletin is heavy in volume, containing a range of critical and high-severity patches,” Jamf senior enterprise strategy manager Adam Boynton noted. “Most concerning from this list is CVE-2026-28662 because it’s a Wi-Fi-related memory corruption flaw. If left unpatched, it could enable attackers to execute code remotely, without any additional privileges or user interaction, potentially allowing privilege escalation.”
Devices updated to a security patch level of 2026-09-05 or newer contain patches for all these vulnerabilities, as well as for the flaws resolved with the previous Android patches. There are no specific security patches for Wear OS, Android XR, and Android Automotive OS this month, though their updates address all issues described in the September 2026 Android security bulletin.