Google's Android Security Bulletin for September 2026 (published 8 September 2026, updated 12 October) says security patch levels of 2026-09-05 or later address all of its issues.

Google says the most severe is a critical vulnerability in the System component that could lead to remote code execution with no additional execution privileges needed and no user interaction.

The bulletin lists CVE-2026-28662 as a Critical remote code execution flaw in System affecting Android 16, 16-qpr2 and 17.

Primary: Android Security Bulletin.

Correction (25 Oct 2026): the card now leads with Google's bulletin and its own description of the most severe flaw; a total-flaw count, a Wi-Fi description of CVE-2026-28662 and a note on Wear OS, Android XR and Android Automotive OS, which came from a wire report we cannot verify, have been removed. (source: Android Security Bulletin, September 2026)