Overview
- Google published its September 2026 Android Security Bulletin that covers Android 14 through 17 and lists fixes for numerous framework, system and kernel issues including several that enable remote code execution or privilege escalation.
- Coverage differs on scope with many outlets reporting more than 90 fixed vulnerabilities and one report citing 180 total, reflecting different ways of counting AOSP, kernel/chipset and vendor entries across two patch levels (2026-09-01 and 2026-09-05).
- Some fixes are delivered by Google through Google Play/Mainline modules but most require device-manufacturer firmware updates, so protection depends on each OEM’s rollout schedule and which models remain in support.
- Samsung published its own September bulletin that adds 31 vendor-specific fixes and two critical heap-based buffer‑overflow bugs in its image decoder libraries (SVE-2026-3247/CVE-2026-21095 and SVE-2026-3282/CVE-2026-21096) and has started rolling patches to Galaxy devices on a device-class cadence.
- Users should install any available Play system updates and firmware patches promptly because devices that no longer receive OEM updates or that await delayed rollouts remain at higher risk; Google’s switch to larger quarterly Android packages and Project Mainline means some fixes arrive via Play while others wait for OEM firmware.