Google’s October 2026 Android security bulletin, shipping as patch level 2026-10-01, closes 25 vulnerabilities across Framework and System, seven of them critical, with the most severe allowing local privilege escalation in System with no added execution privileges and no user interaction. Apply the update as soon as your devices receive it, and treat the Pixel bulletin as a separate, mandatory step.

MediaTek’s October 2026 security bulletin closes 31 flaws, including two critical out-of-bounds writes in the modem (CVE-2026-20519 and CVE-2026-20520) that a rogue base station can trigger to escalate privileges with no user interaction. Treat the gap between MediaTek’s fix and its distribution by device makers as a risk in its own right, and audit the patch level of your Android fleet.

The GitHub Security Lab Taskflow Agent found 24 real Android vulnerabilities, from location tracking in OsmAnd to a full Wikipedia account takeover. AI can now find high-impact logic bugs, but still struggles to rank their severity.

On September 18, 2026, Google submitted the patch that removes 11,000 lines of the C Binder driver, replaced by the Rust version upstreamed in Linux 6.18 and slated for Linux 7.4. It is the first time a major kernel driver moves entirely to Rust.

On September 16, 2026 Google confirmed exploitation of CVE-2026-58704, a privilege escalation in the Pixel cellular modem, in limited targeted attacks. Apply the September 2026 patch and make the Android patch level a compliance gate for your mobile fleet.

On August 31, 2026, researcher Lukas Maar published OEMpocalypse, an exploit chain that elevates any permissionless Android app to root on Samsung Galaxy S23–S26, Xiaomi flagships and Oppo/OnePlus/Realme devices — locked bootloader, Verified Boot still green. Your root detection is blind to it: only hardware-backed keys (KeyStore/StrongBox) still hold.

An infection chain targeting Android car head units delivers the JarService malware through DoFun’s own TWCore update app. Kaspersky attributes the operation to the MoYu group behind the BadBox botnet — the first documented malware chain built specifically for this class of device.