Android security tags, read closely
Each month, the Android Security Bulletin joined with the code that actually ships in the public security tags of Android 14 to 17.
What the Android Security Bulletin does not tell you
23%of the security fixes in the
public tags carry a bug id that no bulletin mentions.
105CVEs had a public fix before their announcement: a median of 56 days early (up to 756).
4announced CVEs have no public code in the security tags
of the majors they affect.
Latest bulletin
October 2026: 25 CVEs for the most covered major, 1 announced CVE with no public code, and up to 1 security fix per tag that no advisory mentions.
All months
Since mid-2025, almost all AOSP CVEs land in the quarterly bulletins (March, June, September, December); the bulletins in between list few or none. Months with no CVE for Android 14 to 17 are left out.
2026
| October | 25 CVEs, Android 14, 15, 16, 17; 1 with no public code |
| September | 81 CVEs, Android 14, 15, 16, 17; 2 with no public code |
| June | 59 CVEs, Android 14, 15, 16, 17 |
| May | 1 CVE, Android 14, 15, 16 |
| April | 1 CVE, Android 14, 15, 16 |
| March | 41 CVEs, Android 14, 15, 16; 1 with no public code |
2025
| December | 38 CVEs, Android 14, 15, 16 |
| November | 1 CVE, Android 14, 15, 16 |
| September | 50 CVEs, Android 14, 15, 16 |
| August | 2 CVEs, Android 14, 15, 16 |
| June | 16 CVEs, Android 14, 15, 16 |
| May | 18 CVEs, Android 14, 15 |
| April | 21 CVEs, Android 14, 15 |
| March | 26 CVEs, Android 14, 15 |
| February | 15 CVEs, Android 14, 15 |
| January | 20 CVEs, Android 14, 15 |
2024
| December | 6 CVEs, Android 14 |
| November | 14 CVEs, Android 14, 15 |
| October | 7 CVEs, Android 14 |
| September | 10 CVEs, Android 14, 15 |
| August | 11 CVEs, Android 14 |
| July | 6 CVEs, Android 14 |
| June | 17 CVEs, Android 14 |
| May | 8 CVEs, Android 14 |
| April | 8 CVEs, Android 14 |
| March | 12 CVEs, Android 14 |
| February | 10 CVEs, Android 14 |
| January | 8 CVEs, Android 14 |