April 2026: the bulletin, and what actually shipped
The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.
At a glance
| Major | CVEs for it | Fixed | Probable | No public code | Security tags this month |
|---|---|---|---|---|---|
| Android 14 | 1 | 1 | 0 | 0 | android-security-14.0.0_r26 |
| Android 15 | 1 | 1 | 0 | 0 | android-security-15.0.0_r14 |
| Android 16 | 1 | 1 | 0 | 0 | android-security-16.0.0_r5 |
| Android 17 (pre-release, 17-next) | 0 | 0 | 0 | 0 | none |
The bulletin also has 0 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.
What this month's security tags add
Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.
android-security-14.0.0_r26 adds the fix for 1 CVE: CVE-2026-0049.
android-security-15.0.0_r14 adds the fix for 1 CVE: CVE-2026-0049.
android-security-16.0.0_r5 adds the fix for 1 CVE: CVE-2026-0049.
Announced, with no public code
None this month.
Public before it was announced
None this month.
Fixed, by a probable match
None this month.
Security fixes no advisory mentions
Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.
No security tag this month.
Fix analysis AI-generated
For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.
- CVE-2026-0049 · platform/external/dng_sdk (dng_misc_opcodes.cpp
Two-part fix: external/dng_sdk rewrites the plane loop in dng_opcode_MapTable::ProcessArea so the bound no longer computes fAreaSpec.Plane() + fAreaSpec.Planes() (which can wrap in uint32) and marks dng_area_spec::ScaledOverlap no-sanitize for unsigned-integer-overflow; frameworks/base adds a MIME-type allowlist to LocalImageResolver so images in non-allowlisted formats (including DNG) are rejected.
Bulletin revisions
| Version | Date | Notes |
|---|---|---|
| 1.0 | April 6, 2026 | Bulletin published |
| 1.1 | April 8, 2026 | Updated with AOSP links |
- No change seen since tracking started (2026-09-30).
Method and limits
Fixes are found in the public android-security-* tags by the bug id in the
commit message, then Change-Id and patch id against the bulletin's commit, then two probable
matches checked by content. "No public code" means no fixing commit in the ingested tags of
that major, not proof that no fix exists anywhere. When none of the code the bulletin's
commit patches exists in a major (removed or reworked before its release), the CVE is shown
as "patched code absent" instead. Vendor closed-source components and the kernel are out of
scope.
Data for this page (JSON).