Back Hkcert

Android Multiple Vulnerabilities

Hkcert • September 9, 2026

Multiple vulnerabilities were identified in Android. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege, remote code execution and sensitive information disclosure on the targeted system.

Remote Code Execution

Elevation of Privilege

Information Disclosure

System / Technologies affected

Android devices with a security patch level prior to 2026-09-05

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

Vulnerability Identifier

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Android Vulnerabilities Patched in September 2026 Update Google's September 2026 Android Security Bulletin addresses 180 vulnerabilities, including 95 bugs from the 2026-09-01 patch level and 85 from the 2026-09-05 patch level. The most severe vulnerability, CVE-2026-28662, allows remote code execution without user interaction. Samsung's September update also fixes 90 vulnerabilities, including critical Android flaws that could enable remote code execution. Affected systems include Android devices with security patch levels prior to 2026-09-05. Organizations are urged to update their devices promptly to mitigate risks. The updates are crucial for maintaining device security and preventing potential exploitation. Security professionals should prioritize patching to protect against these vulnerabilities. 50 sources 73

Extracted Entities

Android Multiple Vulnerabilities

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (4)

MITRE ATT&CK (3)

Platforms (1)