THE CRUNCH
Google has rolled out its October 2026 Android security updates, resolving 25 vulnerabilities across the Framework and System components under the 2026-10-01 patch level. Seven of the flaws are rated critical: one in Framework and six in System. The most severe is a critical bug in the System component that Google says could allow local privilege escalation with no extra execution privileges and no user interaction needed for exploitation. Notably, this release arrives as a single update, a change from the two-part updates Google has issued over the past several years.
The Framework fixes cover two denial-of-service bugs and five elevation-of-privilege flaws. In System, Google patched eight elevation-of-privilege issues, five denial-of-service bugs, one remote code execution flaw and four information disclosure issues. Three further defects, one in Telephonycore and two in WiFi, are addressed through Google Play system updates.
Pixel devices get additional fixes for six vulnerabilities, including three critical-severity issues affecting the Bluetooth, GDMC and GSA components. The Android Automotive OS update carries all the October fixes plus patches for five other high-severity elevation-of-privilege bugs. Google's advisory makes no mention of any of these vulnerabilities being exploited in the wild, but the company still advises users to update promptly.