June 2026: the bulletin, and what actually shipped

The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.

At a glance

The bulletin also has 52 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.

What this month's security tags add

Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.

android-security-14.0.0_r28 adds the fix for 46 CVEs: CVE-2025-26418, CVE-2025-48570, CVE-2025-48595, CVE-2025-48612, CVE-2025-64505, CVE-2025-64720, CVE-2025-65018, CVE-2026-0036, CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0045, CVE-2026-0046, CVE-2026-0048, CVE-2026-0051, CVE-2026-0052, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0078, CVE-2026-0079, CVE-2026-0080, CVE-2026-0085, CVE-2026-0087, CVE-2026-0088, CVE-2026-0091, CVE-2026-0093, CVE-2026-0095, CVE-2026-0097, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-21352, CVE-2026-21353, CVE-2026-28577, CVE-2026-28578.

android-security-15.0.0_r16 adds the fix for 48 CVEs: CVE-2025-26418, CVE-2025-48595, CVE-2025-48612, CVE-2025-64505, CVE-2025-64720, CVE-2025-65018, CVE-2026-0009, CVE-2026-0018, CVE-2026-0036, CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0045, CVE-2026-0046, CVE-2026-0048, CVE-2026-0050, CVE-2026-0051, CVE-2026-0052, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0078, CVE-2026-0079, CVE-2026-0080, CVE-2026-0085, CVE-2026-0087, CVE-2026-0088, CVE-2026-0091, CVE-2026-0093, CVE-2026-0095, CVE-2026-0097, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-21352, CVE-2026-21353, CVE-2026-28577, CVE-2026-28578.

android-security-16.0.0_r7 adds the fix for 49 CVEs: CVE-2025-48581, CVE-2025-48595, CVE-2025-48612, CVE-2025-64505, CVE-2025-64720, CVE-2025-65018, CVE-2026-0016, CVE-2026-0036, CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0045, CVE-2026-0046, CVE-2026-0048, CVE-2026-0050, CVE-2026-0051, CVE-2026-0052, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0075, CVE-2026-0076, CVE-2026-0078, CVE-2026-0079, CVE-2026-0080, CVE-2026-0085, CVE-2026-0087, CVE-2026-0088, CVE-2026-0091, CVE-2026-0093, CVE-2026-0095, CVE-2026-0096, CVE-2026-0097, CVE-2026-0098, CVE-2026-0099, CVE-2026-0100, CVE-2026-21352, CVE-2026-21353, CVE-2026-28574, CVE-2026-28577, CVE-2026-28578.

Announced, with no public code

None this month.

Public before it was announced

The fixing commit was in a public security tag before the bulletin announced the CVE.

Fixed, by a probable match

These fixes carry a different trace from the bulletin's commit (another bug id, no Bug line, a merge), and were matched by content. Similarity is the share of the reference's changed lines found in the commit.

Security fixes no advisory mentions

Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.

Android 14: 8 fixes in android-security-14.0.0_r28

Android 15: 10 fixes in android-security-15.0.0_r16

Android 16: 11 fixes in android-security-16.0.0_r7

Fix analysis AI-generated

For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.

• CVE-2025-26418 · platform/packages/services/Car
  Adds a MANAGE_USERS-or-INTERACT_ACROSS_USERS permission check to CarDevicePolicyService.setUserDisclaimerAcknowledged and a matching @RequiresPermission annotation on CarDevicePolicyManager. Callers without either permission can no longer have the car service acknowledge the new-user disclaimer.
• CVE-2025-32348 · platform/frameworks/base
  Stops treating a process whose only visible activity is in pinned (PIP) windowing mode as "has a visible window / foreground task" for background activity launch (BAL) exemptions. It does this by adding VisibleActivityProcessTracker.hasVisibleNotPinnedActivity and an inPinnedWindow parameter to BackgroundLaunchProcessController.areBackgroundActivityStartsAllowed.
• CVE-2025-48570 · platform/frameworks/base
  The fix adds a 3-second check to PipTaskOrganizer#onTaskAppeared in WM Shell: if no PiP-entering transition state change follows a pinned task appearing (the commit attributes this to a SystemUI reboot), tasks whose top activity matches that component are removed.
• CVE-2025-48581 · platform/system/apex
  Adds sub_dir: "sysconfig" to the apexd.mainline_patch_level_2 prebuilt_etc module in platform/system/apex so the com.google.android.mainline.patchlevel.2.xml feature declaration is installed under the sysconfig directory, where it becomes accessible to the device.
• CVE-2025-48595 · platform/external/sqlite (libsqlite3 amalgamation dist/sqlite3.c
  Google fixed CVE-2025-48595 by moving the bundled SQLite library to a patched upstream point release instead of applying a single targeted patch. On Android 14 that meant 3.42.0 to 3.42.1, after a first 3.39.6 update was reverted. On Android 15 and 16 it meant RELEASE_PACKAGE_LIBSQLITE3 flag changes (Android 15: trunk_staging flag file deleted; Android 16: ap3a moved to 3.44.5).
• CVE-2025-48612 · platform/packages/apps/Settings
  In Settings' NFC default payment app selector, the picker key used to be a "flattenedComponentName userId" string that was parsed back on selection. The fix replaces it with an opaque hash key looked up in a map of PaymentAppInfo entries, so the component and user passed to setDefaultPaymentApp always come from an enumerated candidate instead of a string parse.
• CVE-2025-48615 · platform/frameworks/base
  Adds a 1024-character cap on media button receiver component names in MediaButtonReceiverHolder, first for components resolved from a PendingIntent (skipped with a warning) and then for ComponentName broadcast receivers (rejected with IllegalArgumentException).
• CVE-2025-48616 · platform/frameworks/base
  KeyguardViewMediator now queries KeyguardUpdateMonitor.isUserInLockdown instead of LockPatternUtils.isUserInLockdown at the three places that decide whether lockdown forces the keyguard to show or prevents it from being hidden.
• CVE-2025-48648 · platform/frameworks/base
  NotificationManagerService stops relying on PackageManagerInternal.isSameApp (which, per the commit message, carries an SDK sandbox exception) for its caller-owns-package enforcement and instead compares the caller uid directly against the package uid, and additionally rejects SDK sandbox uids in areNotificationsEnabledForPackage and checks system/SystemUI/shell identity before canNotifyAsPackage in getConversationNotificationChannel.
• CVE-2025-48649 · platform/frameworks/base
  Threads a restorePregrantedPermissions flag from ActivityManager through ActivityManagerService, PackageManagerService and PermissionManagerServiceImpl so that an app clearing its own data (public ActivityManager.clearApplicationUserData()) no longer gets default- or role-granted runtime permissions re-granted by the system, while callers holding CLEAR_APP_USER_DATA keep the old restoring behaviour.
• CVE-2025-48652 · platform/frameworks/base
  PackageInstaller's InstallStart no longer lets a caller that holds INSTALL_PACKAGES skip the unknown-sources user-restriction checks when it starts the installer with an ACTION_VIEW or ACTION_INSTALL_PACKAGE intent. The bypass now applies only to non-intent installs by INSTALL_PACKAGES holders and to privileged callers that set EXTRA_NOT_UNKNOWN_SOURCE.
• CVE-2025-64505 · platform/external/libpng
  libpng png_set_quantize now allocates and identity-initialises the quantize_index lookup table to PNG_MAX_PALETTE_LENGTH (256) bytes instead of num_palette bytes, so out-of-range palette indices from a malformed PNG no longer read past the table in png_do_quantize; a companion commit frees the previous quantize_index before reallocating and makes quantize_sort a local variable to stop leaks on repeated calls.
• CVE-2025-64720 · platform/external/libpng
  In libpng pngrtran.c png_init_read_transformations, the palette tRNS compositing loop now branches on PNG_FLAG_OPTIMIZE_ALPHA. When the flag is set, each palette component is only premultiplied by its alpha (with gamma correction) and is not composited against the background. Palette values then keep the premultiplied invariant component <= alpha, which png_image_read_composite relies on for its png_sRGB_base[]/png_sRGB_delta[] table lookups.
• CVE-2025-65018 · platform/external/libpng
  Fixes a heap buffer overflow in libpng's simplified read API (png_image_finish_read / png_image_read_direct) when a 16-bit PNG is read into an 8-bit output buffer: first by rejecting IHDR/output bit-depth mismatches, then (rearchitected) by routing interlaced 16-to-8 conversions through an intermediate local_row buffer in a new png_image_read_direct_scaled routine.
• CVE-2026-0009 · platform/packages/providers/MediaProvider
  Removes the Photopicker's automatic finish-on-first-selection behaviour in single-select mode and instead always enables the selection bar so the user must explicitly confirm the selected media before it is returned to the calling app.
• CVE-2026-0016 · platform/frameworks/base
  Makes Credential Manager package-update handling user-correct: CredentialManagerService.updateProvidersWhenServiceRemoved now reads and writes the Secure settings of the passed userId instead of UserHandle.myUserId(), and AbstractMasterSystemService.removeInvalidCachedServicesLocked only acts on cached services belonging to the user whose package changed.
• CVE-2026-0018 · platform/frameworks/base
  AccessibilityManagerService now validates each app-declared accessibility QS tile service through PackageManagerInternal, outside the service lock: the service must resolve, be exported, be protected by BIND_QUICK_SETTINGS_TILE and be enabled. AccessibilityUserState records a feature-to-tile mapping only when the tile component is in that validated set.
• CVE-2026-0036 · platform/frameworks/base
  Adds a shell-side check in StageCoordinator.startAnimation. When split is not active, it detects a split-enter transition whose opening tasks belong to only one split stage and starts a follow-up TRANSIT_CLOSE transition that reparents those tasks back to the TaskDisplayArea. Previously such tasks were left to the default transition handler, which showed them outside of split.
• CVE-2026-0039 · platform/external/dng_sdk
  Rebuilds libdng_sdk so that UBSan signed/unsigned integer-overflow checks call a library-private runtime that throws std::runtime_error, replacing the ubsan-minimal runtime that hard-aborts the process when an overflow is detected.
• CVE-2026-0040 · platform/external/dng_sdk
  Rebuilds libdng_sdk in platform/external/dng_sdk so that signed/unsigned integer overflow detected by UBSan throws a C++ std::runtime_error (through a new in-tree runtime, ubsan-replacement/ubsan_throwing_runtime.cpp) instead of using the ubsan-minimal runtime, which hard-aborts.
• CVE-2026-0041 · platform/external/dng_sdk
  Rebuilds libdng_sdk without the ubsan-minimal runtime and links a project-local replacement (ubsan-replacement/ubsan_throwing_runtime.cpp) whose integer-overflow handlers throw std::runtime_error, so a UBSan-detected signed/unsigned integer overflow in libdng_sdk becomes a C++ exception instead of a hard abort.
• CVE-2026-0042 · platform/external/dng_sdk: the libdng_sdk build (Android.bp) and a new ubsan-replacement runtime. The test points to the ImageDecoder DNG path as the consumer.
  Rebuilds libdng_sdk (platform/external/dng_sdk) so that UBSan integer-overflow detections throw a C++ std::runtime_error instead of going to the ubsan minimal runtime, which does a hard abort.
• CVE-2026-0043 · platform/external/dng_sdk
  Rebuilds libdng_sdk with Soong sanitizer integration disabled (sanitize.never), adds explicit -fsanitize=signed-integer-overflow,unsigned-integer-overflow plus -fno-sanitize-link-runtime, and links a new in-tree UBSan handler file (ubsan-replacement/ubsan_throwing_runtime.cpp). Its overflow handlers throw std::runtime_error instead of the ubsan-minimal hard abort.
• CVE-2026-0044 · platform/external/dng_sdk
  Rebuilds libdng_sdk so that integer-overflow sanitizer hits throw a C++ exception (handlers in the new file ubsan-replacement/ubsan_throwing_runtime.cpp) instead of going to the ubsan minimal runtime, which aborts the process.
• CVE-2026-0045 · platform/packages/modules/Bluetooth
  In the Bluetooth stack's btm_sec_is_upgrade_possible (system/stack/btm/btm_sec.cc), the fix makes the function return true when a link key is known, the service requires authentication in the relevant direction and the peer's bond is temporary; the code comment says this is meant to trigger pairing.
• CVE-2026-0046 · platform/frameworks/base
  The fix makes the Letterbox input window (InputInterceptor in Letterbox.java) report the surrounded app's pid/uid as its owner instead of system_server's, so the input layer's obscured-touch (tapjacking) checks no longer treat the letterbox as a trusted system window.
• CVE-2026-0048 · platform/frameworks/base
  WindowState.hide() now hides a force-hidden window (non-system overlay, suspended owner, app-op hidden, or permanently hidden) immediately when that window is already playing an exit animation, and cancels any in-progress animation, instead of letting the hide wait for the previous exit animation to finish.
• CVE-2026-0050 · platform/packages/modules/Bluetooth
  AdapterService.handleBondStateChanged now also revokes the stored per-device access permissions (message, phonebook and a third stored permission) when a device's bond state leaves BOND_BONDED (fromState == BOND_BONDED), not only when it reaches BOND_NONE. A device that reuses a bonded address and tries to rebond therefore loses the previously granted permissions, and the user is asked for consent again.
• CVE-2026-0051 · platform/external/dng_sdk
  Rebuilds libdng_sdk so that the integer-overflow UBSan checks call a library-private runtime that throws std::runtime_error instead of the ubsan-minimal runtime that aborts the process, turning overflow detections on malformed DNG input into recoverable C++ exceptions.
• CVE-2026-0052 · platform/external/dng_sdk
  Rebuilds libdng_sdk so that UBSan integer-overflow detections throw a C++ std::runtime_error from a handler runtime inside the project, instead of aborting the process through the default ubsan-minimal runtime.
• CVE-2026-0055 · platform/frameworks/base
  PackageInstallerService.createSessionInternal now checks the caller-supplied SessionParams.volumeUuid with StorageManager.convert() when INSTALL_FORCE_VOLUME_UUID is set. Invalid values are rejected with an IllegalArgumentException when the session is created, instead of passing into later install handling.
• CVE-2026-0056 · platform/frameworks/base
  Adds two validations of ResStringPool_header.styleCount in ResStringPool::setTo (libs/androidfw/ResourceTypes.cpp) so that the declared style offset array cannot overflow its size computation or extend past stringsStart, returning BAD_TYPE for such chunks.
• CVE-2026-0059 · platform/packages/modules/Bluetooth
  Adds a remaining-buffer-length parameter and check to sdpu_build_attrib_seq, and adds buffer accounting to process_service_attr_rsp, so the SDP client can no longer write an attribute ID sequence past the end of the SDP_DATA_BUF_SIZE request buffer.
• CVE-2026-0060 · platform/packages/apps/Settings
  Gates the Developer Options "Enable ANGLE" switch in Settings behind a debug system property (debug.graphics.angle.developeroption.enable), keeps the switch usable when ANGLE is already active so it can be turned off, relabels the option as experimental, and rewrites the summary and reboot-dialog warnings (back up data; a failed restart needs a factory reset).
• CVE-2026-0061 · platform/frameworks/base
  WindowState now applies the server-side visibility policy (hide/show) to the WindowState's own mSurfaceControl through the pending transaction, in addition to the existing mWinAnimator handling, so policy visibility no longer depends only on a surface the client can access.
• CVE-2026-0067 · platform/external/dng_sdk
  In external/dng_sdk, libdng_sdk stops using the Soong-managed ubsan_minimal runtime and instead enables the signed/unsigned integer-overflow sanitizers via cflags with -fno-sanitize-link-runtime, plus a bundled ubsan_throwing_runtime.cpp whose __ubsan_handle_*_overflow handlers throw std::runtime_error, so detected overflows become C++ exceptions rather than a hard abort.
• CVE-2026-0070 · platform/frameworks/base
  DevicePolicyManagerService.setApplicationHidden() now refuses (returns false) to hide packages listed in a new framework resource array application_hidden_policy_exempt_apps (com.android.nfc, com.android.settings, com.android.providers.settings), because per the commit message hiding these critical apps in the work profile may cause failure to boot.
• CVE-2026-0074 · platform/frameworks/base (graphics/java/android/graphics/ImageDecoder.java) and platform/packages/apps/Launcher3 (quickstep
  Adds process-level and thread-level default OnHeaderDecodedListener hooks to android.graphics.ImageDecoder and registers a Launcher (Quickstep) process default listener that rejects non-allowlisted image mime types and downscales images whose estimated decoded size exceeds a configured memory budget (300 MB).
• CVE-2026-0075 · platform/packages/providers/ContactsProvider
  When the caller lacks the provider's READ_PERMISSION (query; READ_CONTACTS according to the commit message) or WRITE_PERMISSION (insert/update/delete), ContactsProvider2 now replaces any SQLiteException whose message contains "json" with one carrying the fixed message "Stripped exception message". It also calls cursor.getCount() inside the try block of query so that deferred SQLite errors are caught and filtered too.
• CVE-2026-0076 · platform/frameworks/base
  Adds a minimum-size check on ResXMLTree_attrExt::attributeSize in ResXMLTree::validateNode so binary XML nodes declaring an attribute size smaller than sizeof(ResXMLTree_attribute) are rejected with BAD_TYPE instead of being parsed.
• CVE-2026-0078 · platform/frameworks/base
  DevicePolicyManagerService.setGlobalProxy now rejects proxySpec and exclusionList strings whose modified-UTF-8 encoding exceeds 65535 bytes (via PolicySizeVerifier.enforceMaxStringLength) before storing them in the admin's policy state.
• CVE-2026-0079 · platform/external/dng_sdk
  libdng_sdk stops linking the aborting ubsan-minimal runtime and instead ships its own hidden __ubsan_handle_*_overflow handlers that throw std::runtime_error, so integer overflows detected in the library become C++ exceptions rather than a process abort.
• CVE-2026-0080 · platform/external/dng_sdk
  Rebuilds libdng_sdk so that UBSan integer-overflow detections throw a C++ std::runtime_error (via a bundled replacement runtime in ubsan-replacement/ubsan_throwing_runtime.cpp) instead of aborting the process through the ubsan-minimal runtime.
• CVE-2026-0085 · platform/packages/providers/ContactsProvider
  Makes DataRowHandler.applySimpleFieldMaxSize in ContactsProvider resolve the ContentValues key case-insensitively, so that a Data column supplied with mismatched case (e.g. "DaTa1") is still truncated to the simple-field maximum size instead of bypassing the check.
• CVE-2026-0087 · platform/frameworks/base
  Tightens wildcard domain matching in DomainVerificationService so a verified "*.xyz.com" entry only approves the host "xyz.com" or hosts ending in ".xyz.com", instead of any host whose string ends in "xyz.com" (e.g. "abcxyz.com").
• CVE-2026-0088 · platform/packages/apps/CertInstaller
  CertInstaller.getCallingAppLabel() now gets the calling app's label via ApplicationInfo.loadSafeLabel(pm) instead of loadLabel(pm), so the label shown in the CA certificate redirect dialog is sanitized before display.
• CVE-2026-0091 · platform/frameworks/base
  WM core now records the remote-animation delegate process on the server-side Transition, strips the IApplicationThread from the RemoteTransition it sends to shell, and changes IActivityTaskManager.setRunningRemoteTransitionDelegate to take a transition token instead of an IApplicationThread.
• CVE-2026-0093 · platform/packages/apps/Settings
  Replaces applicationInfo.loadLabel() with applicationInfo.loadSafeLabel(pm, DEFAULT_MAX_LABEL_SIZE_PX, SAFE_STRING_FLAG_TRIM | SAFE_STRING_FLAG_FIRST_LINE) at the three places where Settings renders the requesting app's name in the RequestManageCredentials UI, so an app-controlled label can no longer be used to hide from the user what permissions are requested.
• CVE-2026-0095 · platform/packages/modules/Bluetooth
  Widens the local buf_size in l2c_fcr_clone_buf (system/stack/l2cap/l2c_fcr.cc) from uint16_t to uint32_t so the allocation size for the cloned L2CAP buffer is no longer truncated before osi_malloc, preventing a heap buffer overflow in the following memcpy.
• CVE-2026-0096 · platform/packages/apps/Settings
  Settings' Bluetooth forget-device dialog fragment now loads app labels via ApplicationInfo.loadSafeLabel (MAX_SAFE_LABEL_LENGTH, TRIM | FIRST_LINE flags) instead of the raw PackageManager.getApplicationLabel, so app-supplied labels are sanitized before use in the dialog.
• CVE-2026-0097 · platform/packages/modules/Bluetooth: system/stack/smp (Security Manager Protocol)
  In the LE Secure Connections Passkey Display and Key Notification association models, the fix makes the legacy SMP layer wait for both the local user's approval (SMP_SecurityGrant) and the remote device's passkey confirmation before emitting SMP_KEY_READY_EVT. It treats a user rejection as an authentication failure, cancels LE pairing on authentication timeout, and sets the default LE pairing flags (is_le_only/is_le_nc) in btif for passkey notification.
• CVE-2026-0098 · platform/packages/apps/DocumentsUI
  DocumentsUI's Shared.getCallingPackageName now honors the EXTRA_PACKAGE_NAME calling-package override only when the caller's signature matches the platform (SYSTEM_UID) signature. Before, it honored it for any caller flagged as a system or updated system app.
• CVE-2026-0099 · platform/packages/apps/Nfc (platform/packages/modules/Nfc on 16+)
  Adds onBindingDied and onNullBinding handlers to the ServiceConnection objects in HostEmulationManager so the NFC service unbinds from a HostApduService whose binding died or whose onBind returned null, instead of leaving the binding in place.
• CVE-2026-0100 · platform/frameworks/base
  Adds a range check in LoadedPackage::Load (libs/androidfw/LoadedArsc.cpp) so that a RES_TABLE_PACKAGE_TYPE chunk whose 32-bit package id exceeds 255 is rejected and the ARSC fails to load instead of being accepted with an out-of-range package id.
• CVE-2026-21352 · platform/external/dng_sdk (Adobe DNG SDK: JXL codec glue
  Updates external/dng_sdk from 1.7.1 build 2410 to 2471. The update adds integer-overflow checks around JXL decode/encode buffer sizing and allocations, fixes an off-by-one table index in dng_opcode_MapTable::ReplicateLastEntry, and guards several divisions by zero that occur when blackLevel is 65535.
• CVE-2026-21353 · platform/external/dng_sdk (Adobe DNG SDK 1.7.1): JXL codec glue (dng_jxl.cpp)
  Updates external/dng_sdk from build 2410 to 2471, adding overflow-checked arithmetic and range checks to the JXL decode/encode pixel-buffer geometry and allocation sizes in dng_jxl.cpp, an overflow check in dng_ref_counted_block::Allocate, an off-by-one fix in dng_opcode_MapTable::ReplicateLastEntry, and division-by-zero guards for blackLevel == 65535 in the GainMap, MapTable, Vignette and BaselineMapPoly paths.
• CVE-2026-28574 · platform/packages/modules/Nfc
  In HostEmulationManager.HostEmulationServiceConnection.onServiceConnected, when the HCE state is already STATE_IDLE and the connected service is not the preferred service, the fix now unbinds the service connection and removes its entry from mComponentNameToConnectionsMap. Before the fix, the code returned and left the binding alive.
• CVE-2026-28577 · platform/frameworks/base
  WindowManagerService.addWindow now rejects a TYPE_TOAST window with ADD_BAD_APP_TOKEN when addToastWindowRequiresToken is true and the target WindowToken already contains a window, enforcing one toast window per toast token.
• CVE-2026-28578 · platform/frameworks/base
  Adds a per-package-name length check (enforcePackagePolicyPackageNamesLength) to the three DevicePolicyManagerService setters that accept a PackagePolicy (managed profile caller-id/contacts access policies and credential manager policy), rejecting overlong package names before the policy is processed.

Bulletin revisions

• 2026-10-13: removed CVE-2026-0069 (bulletin version 1.4)
• 2026-10-13: removed CVE-2026-0094 (bulletin version 1.4)

Method and limits

Fixes are found in the public android-security-* tags by the bug id in the commit message, then Change-Id and patch id against the bulletin's commit, then two probable matches checked by content. "No public code" means no fixing commit in the ingested tags of that major, not proof that no fix exists anywhere. When none of the code the bulletin's commit patches exists in a major (removed or reworked before its release), the CVE is shown as "patched code absent" instead. Vendor closed-source components and the kernel are out of scope.

Data for this page (JSON).