Android September 2026 Updates Patch 180 Vulnerabilities, Including Critical RCE Flaws

Extensive Security Update Released

Google announced the release of its September 2026 Android security updates, which resolve 180 vulnerabilities. This follows two consecutive months (July and August) where no security bulletins were issued for Android.

Two-Part Patch Level Deployment

The updates are divided into two security patch levels. The 2026-09-01 patch level addresses 95 bugs across Android runtime, Framework, System, Setup Wizard, and Project Mainline components. The 2026-09-05 patch level includes fixes for 85 security defects in Android's kernel and components from vendors like Arm, Imagination Technologies, MediaTek, Tsingteng Micro, Unisoc, and Qualcomm.

Critical Vulnerabilities Addressed

A critical security vulnerability in the System component, leading to remote code execution (RCE) without user interaction or additional privileges, is among the most severe issues patched. The update fixes 56 security defects in the System component, including 23 critical-severity flaws that could lead to RCE, elevation of privilege (EoP), and denial-of-service (DoS). Additionally, 37 vulnerabilities in the Framework component, including three critical bugs, and one flaw in Android runtime were resolved.

Specific Concerns Highlighted

One notable vulnerability is CVE-2026-28662, a Wi-Fi-related memory corruption flaw. If unpatched, this could allow attackers to execute code remotely without additional privileges or user interaction, potentially leading to privilege escalation. Organizations are advised to apply these updates promptly across their device fleets.

Broader OS Coverage

While there are no specific security patches listed for Wear OS, Android XR, and Android Automotive OS this month, their updates incorporate all the fixes detailed in the September 2026 Android security bulletin.