Google published the September 2026 Android Security Bulletin on 8 September and revised it three times, the last on 17 September. It covers 178 CVEs across two patch levels, 2026-09-01 and 2026-09-05, and 30 of them are rated Critical. Google's summary calls out a Critical issue in the System component that "could lead to remote code execution with no additional execution privileges needed," with no user interaction.
For teams that build Android apps or run device labs, three parts of this bulletin deserve more than a glance: a Critical fix in adbd, Critical fixes in Protected KVM, and two upstream Linux kernel CVEs that were public months before they reached this bulletin. The bulletin itself makes no statement about exploitation in the wild.
What's affected
Android 14, 15, 16 and 17 builds below the listed patch levels. A device reporting 2026-09-05 or later has every fix in the bulletin. A device at 2026-09-01 has the framework and system fixes but not the kernel and vendor ones.
2026-09-01 patch level (Android platform). Framework has 36 entries, two of them Critical. System has 55 entries, 22 of them Critical: 8 remote code execution, 11 elevation of privilege and 3 denial of service. Several of these ship through Google Play system updates (Project Mainline) instead of a full OTA:
- adbd: CVE-2026-28604, Critical RCE. The CVE record describes "a possible use after free due to a race condition" in multiple locations, with no extra privileges or user interaction needed.
- WiFi: CVE-2026-28662 (Critical RCE), plus CVE-2026-28617 and CVE-2026-49895.
- Media Codecs: CVE-2026-28618 (Critical RCE) and CVE-2026-55294.
- MediaProvider, Telephony, UWB, Documents UI and ART also have entries.
2026-09-05 patch level (kernel and vendors).
- Protected KVM: CVE-2026-58846, CVE-2026-58848 and CVE-2026-58941, all Critical elevation of privilege. CVE-2026-58846 is a use after free in
kvm_iommu_map_sgcaused by a missing permission check. - NFC: CVE-2026-31629, Critical EoP. This is the upstream Linux fix "nfc: llcp: add missing return after LLCP_CLOSED checks", whose CVE record was published on 24 April 2026.
- TIPC: CVE-2026-52993, Critical RCE. This is the upstream fix "tipc: fix double-free in tipc_buf_append()", published as a CVE on 24 June 2026 with a CVSS 3.1 score of 9.8.
- Vendor components: Arm Mali (6), Imagination PowerVR (25), MediaTek (21), Unisoc (7), Qualcomm (5 open, 11 closed source, one Critical) and one Tsingteng StrongBox issue.
How to check if you're exposed
Read the patch level and the Mainline module versions on each device you care about: test phones, CI emulators with Play images, kiosk and field devices.
# Security patch level (needs 2026-09-05 for full coverage)
adb shell getprop ro.build.version.security_patch
# Kernel version, to compare with your OEM's kernel notes
adb shell uname -r
# Mainline (APEX) modules and their version codes
adb shell pm list packages --apex-only --show-versioncode
For fleets managed through an MDM, export the "security patch level" field and sort ascending. Any device still reporting a 2026-08 or earlier level is missing all of the September fixes.
Then find devices where adbd is reachable. USB debugging and wireless debugging are both developer options, and lab devices often have them on permanently.
adb devices -l
adb shell settings get global adb_enabled
adb shell settings get global adb_wifi_enabled
What to do now
- Update devices to the 2026-09-05 level where your OEM has shipped it. Each manufacturer publishes on its own schedule, so check the vendor's bulletin page, not just Google's.
- Install pending Google Play system updates (Settings, Security and privacy, System and updates). The adbd, WiFi and Media Codecs fixes travel this way, so a device can pick them up even before its OEM ships a full OTA.
- Turn off wireless debugging on shared and lab devices when nobody is actively using it, and keep USB debugging off on any device that leaves your desk. The bulletin doesn't give an attack path for CVE-2026-28604, so reducing who can talk to
adbdis the cautious choice until devices are patched. - Retire or isolate devices your OEM no longer patches. A device stuck on an old patch level will never receive the pKVM, NFC or TIPC kernel fixes.
- Check your own Linux hosts for the same kernel CVEs. CVE-2026-31629 and CVE-2026-52993 are upstream kernel bugs, so servers and CI runners need their distribution kernel updates too.
Why it matters
The two kernel CVEs show a gap worth tracking. CVE-2026-31629 was public in April and CVE-2026-52993 in June, yet they appear in the Android bulletin under the 2026-09-05 level. That is the normal path from upstream Linux to Android device kernels, but it means a scanner watching only Android bulletins sees these bugs months after a scanner watching kernel CVEs does.
The Mainline split matters in the other direction. Many critical userspace fixes no longer wait for an OEM OTA, which helps app developers whose users are on slow-updating devices. But it also means "patch level" alone doesn't describe a device. You need both the patch level and the module versions.
Try it yourself
Pick three devices: your daily test phone, an emulator image used in CI, and the oldest device your app still supports. Record the patch level, kernel version and com.google.android.wifi and com.android.adbd module version codes on each. Mark which of the September fixes each one actually has.
Click through it at your own pace, or open it full screen.
Quick check
A device reports patch level 2026-09-01. Does it have the pKVM fixes?
No. The Protected KVM, NFC and TIPC kernel fixes are in the 2026-09-05 patch level. Only 2026-09-05 or later covers the whole bulletin.
Can a device get the adbd fix before its manufacturer ships a September OTA?
Yes, if it receives the Google Play system update. The bulletin lists adbd (CVE-2026-28604) among the Project Mainline components.
Why does an April 2026 Linux kernel CVE appear in a September Android bulletin?
Upstream kernel fixes reach Android device kernels on Android's own schedule. CVE-2026-31629 was published upstream on 24 April and listed in this bulletin under the 2026-09-05 level.
