Google Patches 180 Android Vulnerabilities Including Critical RCE Flaws

Google has released a significant batch of security updates for the Android operating system, addressing 180 vulnerabilities. The patches resolve several critical flaws, including issues that could allow for remote code execution (RCE) without requiring user interaction or additional privileges.

The September 2026 security updates are distributed in two parts. The first part, the 2026-09-01 security patch level, addresses 95 bugs across the Android runtime, Framework, System, Setup Wizard, and various Project Mainline components.

Critical System and Wi-Fi Vulnerabilities

A substantial portion of the updates focuses on the System component, which manages core mobile functionalities. Google identified 56 security defects within this component, 23 of which are classified as critical. These flaws could allow attackers to achieve remote code execution (RCE), elevation of privilege (EoP), or denial-of-service (DoS).

Security experts have highlighted CVE-2026-28662 as a particularly high-risk vulnerability. This is a Wi-Fi-related memory corruption flaw that could enable attackers to execute code remotely. Exploitation of this flaw does not require any user interaction or existing privileges on the device, potentially leading to further privilege escalation.

The second part of the update, the 2026-09-05 security patch level, provides fixes for 85 security defects. These patches target the Android kernel and various components from hardware vendors, including Qualcomm, MediaTek, Arm, Imagination Technologies, Unisoc, and Tsingteng Micro.

The updates also extend to other Android-based platforms. While there are no specific individual patches for Wear OS, Android XR, or Android Automotive OS this month, their respective updates include all the fixes described in the September 2026 Android security bulletin.

Security professionals recommend that organisations and individual users update their devices to the 2026-09-05 patch level or newer immediately to mitigate these risks.