September 2026: the bulletin, and what actually shipped

The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.

At a glance

The bulletin also has 81 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.

What this month's security tags add

Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.

android-security-14.0.0_r29 adds the fix for 54 CVEs: CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-27280, CVE-2026-28581, CVE-2026-28582, CVE-2026-28583, CVE-2026-28590, CVE-2026-28593, CVE-2026-28596, CVE-2026-28602, CVE-2026-28603, CVE-2026-28604, CVE-2026-28613, CVE-2026-28614, CVE-2026-28626, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28638, CVE-2026-28639, CVE-2026-28642, CVE-2026-28644, CVE-2026-28650, CVE-2026-28653, CVE-2026-28655, CVE-2026-28656, CVE-2026-28658, CVE-2026-28664, CVE-2026-28668, CVE-2026-28671, CVE-2026-33636, CVE-2026-45515, CVE-2026-45518, CVE-2026-45520, CVE-2026-45521, CVE-2026-45525, CVE-2026-45528, CVE-2026-45529, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49895, CVE-2026-49913, CVE-2026-49919, CVE-2026-49921, CVE-2026-49932, CVE-2026-55256, CVE-2026-55290, CVE-2026-55294, CVE-2026-58822, CVE-2026-58839, CVE-2026-58874.

android-security-15.0.0_r17 adds the fix for 64 CVEs: CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0065, CVE-2026-27280, CVE-2026-28581, CVE-2026-28582, CVE-2026-28583, CVE-2026-28590, CVE-2026-28593, CVE-2026-28596, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28604, CVE-2026-28606, CVE-2026-28607, CVE-2026-28611, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28626, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28638, CVE-2026-28639, CVE-2026-28642, CVE-2026-28644, CVE-2026-28650, CVE-2026-28653, CVE-2026-28655, CVE-2026-28656, CVE-2026-28658, CVE-2026-28660, CVE-2026-28664, CVE-2026-28668, CVE-2026-28671, CVE-2026-33636, CVE-2026-45515, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49895, CVE-2026-49913, CVE-2026-49919, CVE-2026-49921, CVE-2026-49932, CVE-2026-55256, CVE-2026-55290, CVE-2026-55294, CVE-2026-58822, CVE-2026-58839, CVE-2026-58874.

android-security-16.0.0_r8 adds the fix for 76 CVEs: CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0065, CVE-2026-0084, CVE-2026-27280, CVE-2026-28581, CVE-2026-28582, CVE-2026-28583, CVE-2026-28590, CVE-2026-28593, CVE-2026-28596, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28604, CVE-2026-28606, CVE-2026-28607, CVE-2026-28611, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28618, CVE-2026-28620, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28638, CVE-2026-28639, CVE-2026-28642, CVE-2026-28644, CVE-2026-28650, CVE-2026-28652, CVE-2026-28653, CVE-2026-28655, CVE-2026-28656, CVE-2026-28658, CVE-2026-28660, CVE-2026-28662, CVE-2026-28663, CVE-2026-28664, CVE-2026-28668, CVE-2026-28671, CVE-2026-33636, CVE-2026-45515, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49895, CVE-2026-49913, CVE-2026-49919, CVE-2026-49921, CVE-2026-49932, CVE-2026-55256, CVE-2026-55273, CVE-2026-55285, CVE-2026-55290, CVE-2026-55294, CVE-2026-58822, CVE-2026-58839, CVE-2026-58874.

android-security-17.0.0_r1 adds the fix for 77 CVEs: CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28604, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28618, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28638, CVE-2026-28639, CVE-2026-28650, CVE-2026-28652, CVE-2026-28653, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28662, CVE-2026-28663, CVE-2026-28664, CVE-2026-28668, CVE-2026-28671, CVE-2026-33636, CVE-2026-45515, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-45531, CVE-2026-49879, CVE-2026-49881, CVE-2026-49882, CVE-2026-49884, CVE-2026-49887, CVE-2026-49895, CVE-2026-49913, CVE-2026-49918, CVE-2026-49919, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-55256, CVE-2026-55273, CVE-2026-55277, CVE-2026-55285, CVE-2026-55290, CVE-2026-55294, CVE-2026-58822, CVE-2026-58823.

Announced, with no public code

Public before it was announced

The fixing commit was in a public security tag before the bulletin announced the CVE.

Fixed, by a probable match

None this month.

Security fixes no advisory mentions

Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.

Android 14: 42 fixes in android-security-14.0.0_r29

Android 15: 44 fixes in android-security-15.0.0_r17

Android 16: 53 fixes in android-security-16.0.0_r8

Android 17: 49 fixes in android-security-17.0.0_r1

Fix analysis AI-generated

For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.

• CVE-2025-48564 · platform/frameworks/base (core: IntentForwarderActivity
  IntentForwarderActivity now resolves the forwarded intent's MIME type once and passes that single string to both the IPackageManager.canForwardTo check and a new hidden PackageManager.resolveActivityAsUser(Intent, String resolvedType, flags, userId) overload, so the type used for the cross-profile check is the same as the type used for target resolution; the frameworks/base copy also uses getLaunchedFromPackage() for the privileged skip-consent check, and both copies sanitize the intent selector on the resolver path.
• CVE-2025-48565 · platform/frameworks/base
  IntentForwarderActivity now resolves the intent MIME type once and passes that same string to both the IPackageManager.canForwardTo cross-profile check and the target-user activity resolution (via a new hidden PackageManager.resolveActivityAsUser(Intent, String resolvedType, ...) overload), uses getLaunchedFromPackage() instead of getCallingPackage() for the privileged skip-user-consent check, and (after a follow-up on 14) sanitizes intent selectors (package, component, nested selector) in every sanitizeIntent call.
• CVE-2025-48566 · platform/frameworks/base
  IntentForwarderActivity now resolves the received intent's MIME type once and passes that same string both to the IPackageManager.canForwardTo check and to a new PackageManager.resolveActivityAsUser(Intent, String resolvedType, ...) overload. It also sanitizes the received intent's selector and uses getLaunchedFromPackage() instead of getCallingPackage() for the privileged skip-consent check.
• CVE-2026-0008 · platform/packages/apps/Settings
  FaceEnroll in Settings now strips the MultiBiometricEnrollHelper.EXTRA_ENROLL_AFTER_FACE extra (alongside Intent.EXTRA_USER_ID) from the forwarded intent when the activity was launched by a package other than Settings itself.
• CVE-2026-0010 · platform/frameworks/av
  In BnDrmManagerService::onTransact, the fix replaces a fixed 16-byte stack buffer that sprintf("%lu") filled with the file descriptor value by a dynamically sized String8::format("%d", fd). This removes a possible stack buffer overflow when the descriptor value is negative.
• CVE-2026-0054 · platform/frameworks/base
  Adds an onTransact-level caller check to SystemUI's WalletContextualLocationsService binder so that only privileged apps holding the android.app.role.SYSTEM_UI_INTELLIGENCE role can invoke IWalletContextualLocationsService methods; all other callers get a SecurityException.
• CVE-2026-0065 · platform/frameworks/base
  The BAL "bound by foreground UID" exemption in BackgroundLaunchProcessController now requires the binding client UID to have a visible non-pinned (non-PiP) window for activity starts (FGS starts keep the old any-visible-window predicate), and on Android 14/15 additionally requires appSwitchState != APP_SWITCH_DISALLOW unconditionally.
• CVE-2026-0084 · platform/packages/modules/Nfc
  Makes the NFC HostEmulationManager unbind non-preferred HCE service connections right away in two cases, instead of keeping the binding alive until the next NFC transaction: when the preferred service is unset (the app leaves the foreground), and when the regular connection's binding dies.
• CVE-2026-27280 · platform/external/dng_sdk (Adobe DNG SDK)
  Updates external/dng_sdk from DNG SDK 1.7.1 build 2471 to build 2502. In OptimizeOrder (dng_pixel_buffer.cpp), unchecked 32-bit pointer-offset arithmetic is replaced with checked 64-bit arithmetic. dng_render_task::ProcessArea now indexes its temporary RGBTables/mask buffers in source-area coordinates and explicitly requires the src and dst areas to be the same size.
• CVE-2026-28581 · platform/packages/services/Telecomm
  Telecom's CallIntentProcessor.fixInitiatingUserIfNecessary now decides whether a managed (work) profile has a dialer by asking RoleManager for a ROLE_DIALER holder in that user and verifying with PackageManager that the holder package exists and is enabled, instead of checking whether any activity in the profile resolves ACTION_DIAL via DefaultDialerManager.getInstalledDialerApplications.
• CVE-2026-28582 · platform/packages/apps/Settings
  ConfirmDeviceCredentialActivity now finishes immediately when it receives KeyguardManager.ACTION_CONFIRM_REMOTE_DEVICE_CREDENTIAL through any component other than the activity-alias com.android.settings.ConfirmRemoteDeviceCredentialActivity, so the remote-validation flow can no longer be entered by targeting the underlying activity class directly.
• CVE-2026-28583 · platform/system/media
  Corrects validate_camera_metadata_structure in system/media camera_metadata.c so that entry_capacity is converted from an entry count to bytes (times sizeof(camera_metadata_buffer_entry_t)), with an overflow check, before verifying that the entry region ends at or before data_start.
• CVE-2026-28584 · platform/frameworks/base
  PackageInstallerService now deduplicates SessionParams.whitelistedRestrictedPermissions (rebuilding the list from a HashSet) before intersecting it with the platform restricted permission set, so the list can no longer be made arbitrarily long with repeated valid entries.
• CVE-2026-28590 · platform/packages/modules/Bluetooth
  The fix makes the LE Security Manager (SMP) reject a peer Pairing Request/Response whose Maximum Encryption Key Size is below the 7-octet minimum (and adds the same check on the SMP-over-BR/EDR path), routing all minimum-key-size checks through a new btm_sec_get_min_enc_key_size() accessor.
• CVE-2026-28593 · platform/packages/apps/TV (Live TV)
  The Live TV app's "Send Feedback" settings action now builds an explicit intent targeting com.google.android.feedback/com.google.android.feedback.FeedbackActivity instead of an implicit Intent.ACTION_APP_ERROR intent, so the intent can no longer resolve to an arbitrary app that registers for that action.
• CVE-2026-28594 · platform/frameworks/base
  Makes MemoryIntArray pass one explicit element count from Java to both nativeOpen and nativeClose so mmap and munmap always use the same length instead of re-querying the fd's ashmem size, and hardens libcutils ashmem_valid() so a memfd is only accepted as an ashmem replacement when it carries both F_SEAL_GROW and F_SEAL_SHRINK.
• CVE-2026-28596 · platform/frameworks/base
  Adds OutOfMemoryError to the catch clause around the game-mode-config XML meta-data parsing in GameManagerService, so an oversized package XML resource no longer crashes the process; the service falls back to the default game mode flags instead.
• CVE-2026-28599 · platform/frameworks/base
  In ActivityManagerService.addCreatorToken, the targetPackage used for the isCreatorSameAsTarget shortcut no longer falls back to intent.getPackage() when the outer intent has no explicit component. In that case creator tokens are now attached to nested intents instead of being skipped because of a package constraint the caller controls and that a selector could override.
• CVE-2026-28600 · platform/packages/apps/Settings
  PaymentDefaultDialog.onCreate no longer reads a UserHandle from the Intent.EXTRA_USER extra; the user id passed to buildDialog is now always UserHandle.myUserId().
• CVE-2026-28602 · platform/frameworks/base
  ClipboardService now reads and writes the CLIPBOARD_SHOW_ACCESS_NOTIFICATIONS secure setting for the explicit userId (getIntForUser/putIntForUser) instead of getInt/putInt without a user argument, so the clipboard-access notification decision uses the setting of the given user.
• CVE-2026-28603 · platform/packages/apps/Settings
  In Settings' AppRestrictionsFragment, the vetted copy of the app-supplied custom restrictions activity Intent now has all four FLAG_GRANT_*_URI_PERMISSION flags removed and its data and clipData cleared before Settings calls startActivityForResult on it.
• CVE-2026-28604 · platform/packages/modules/adb
  Reworks adbd's adbd_auth_tls_handshake so the detached TLS handshake thread no longer holds a raw atransport pointer. The thread now captures a weak-pointer callback id plus the transport's connection object, and re-enters the fdevent looper to check that the transport is still alive before touching transport state. The fix also splits FdConnection::DoTlsHandshake into host and daemon variants and adds a 3-second socket timeout to the daemon handshake.
• CVE-2026-28606 · platform/packages/modules/Bluetooth
  The Bluetooth AdapterService now removes the per-device CallerInfo entry from mBondAttemptCallerInfo whenever a bond state transition lands in any state other than BOND_BONDING, so caller information from a finished or failed bonding attempt is no longer kept.
• CVE-2026-28607 · platform/frameworks/base
  Adds caller permission checks (REQUEST_INSTALL_PACKAGES requested or INSTALL_PACKAGES granted) plus the hide-non-system-overlays window flag to UnarchiveErrorActivity.onCreate, factors the UID-to-package and requested-permission helpers into PackageUtil, and on Android 17 moves the PIA v2 UnarchiveLaunch forwarding behind those checks.
• CVE-2026-28611 · platform/packages/apps/Nfc (Android 15) / platform/packages/modules/Nfc (Android 16)
  Adds a caller-UID-to-package-name verification (new NfcPermissions.checkPackage backed by AppOpsManager.checkPackage) at the start of the NfcAdapterService binder methods enable, disable and setObserveMode, so a caller can no longer pass an arbitrary package name into NFC authorization decisions.
• CVE-2026-28612 · platform/frameworks/base
  Reorders activity start so that the intent-redirect checks (the EXTENDED_FLAG_MISSING_CREATOR_OR_INVALID_TOKEN check and the IntentCreatorToken-based creator uid/package extraction) run before supervisor.resolveIntent/resolveActivity in both ActivityStarter and ActivityStartController, so that intent resolution can no longer change the intent's component and invalidate the creator token before it is checked.
• CVE-2026-28613 · platform/packages/apps/TV (Live TV)
  ChannelImpl.initAppLinkTypeAndIntent in the Live TV app now refuses to build a channel app-link Intent whose resolved target activity is exported and declares an android:permission. This is in addition to the existing rejection of activities inside the TV app's own package.
• CVE-2026-28614 · platform/frameworks/base
  Adds a caller check to SystemUI's SlicePermissionActivity.onCreate so the slice permission dialog is only shown when the activity was actually launched by the slice provider's package, SystemUI itself, or the "android" package; any other launcher is finished immediately.
• CVE-2026-28617 · platform/packages/modules/Wifi
  The fix makes WifiNetworkSuggestionsManager clear the vendor data (setVendorData(Collections.emptyList())) on every suggested WifiConfiguration before the suggestion is processed, so app-supplied PersistableBundle vendor data no longer enters the suggestion path that the commit message ties to unbounded XmlUtil (de)serialization.
• CVE-2026-28618 · platform/external/libopenapv
  Adds a check in libopenapv's dec_frm_prepare that returns OAPV_ERR_INVALID_ARGUMENT when the plane-0 width or height of the output image buffer supplied by the caller is smaller than the frame dimensions in the Frame PBU header, preventing a heap buffer overflow.
• CVE-2026-28620 · platform/frameworks/base
  Changes the intent-redirection URI grant logic in ActivityStarter and ActivityStartController so that, when an intent's creator UID differs from the launching UID, URI grants are only issued if both the caller's and the creator's checkGrantUriPermissionFromIntent calls yield grants, instead of using or merging whichever party's grants were available; the NeededUriGrants.merge helper is removed.
• CVE-2026-28622 · platform/packages/providers/MediaProvider
  MediaProvider now returns an empty result whenever latitude/longitude columns appear in the SQL selection, GROUP BY or HAVING clause (regardless of whether a sort order is also present), and neutralizes those columns in the sort order with a case-insensitive, word-bounded replacement instead of a case-sensitive substring replace.
• CVE-2026-28623 · platform/packages/modules/Uwb
  Stops the device Bluetooth MAC address from being serialized in BleCsRangingCapabilities and BleRssiRangingCapabilities parcels. The Parcel constructors now always produce the placeholder "00:00:00:00:00:00", while the builder/constructor path used inside the ranging service keeps the real address.
• CVE-2026-28624 · platform/packages/apps/Settings
  Removes the EXTRA_DATA pass-through from ConfirmDeviceCredentialActivity, so the activity no longer echoes a caller-supplied Intent back as its RESULT_OK result, and makes FingerprintSettings keep the gatekeeper password handle in its own state instead of reading it from the returned Intent.
• CVE-2026-28626 · platform/packages/apps/TV (LiveTv)
  Adds a launching-package identity check (getLaunchedFromPackage() on SDK 34+) to SetupPassthroughActivity so that the embedded setup Intent is only forwarded when the activity was launched by CommonConstants.BASE_PACKAGE; otherwise the activity finishes without forwarding.
• CVE-2026-28627 · platform/packages/modules/Bluetooth
  In btm_sec_encrypt_change, a BR/EDR Encryption Change event reporting HCI_ENCRYPT_MODE_ON (E0 encryption) is now checked with btm_sec_is_enc_algo_downgrade and, if the device previously used Secure Connections, the link is disconnected with HCI_ERR_AUTH_FAILURE instead of being accepted as encrypted.
• CVE-2026-28630 · platform/packages/apps/ContactsPicker
  ContactsPickerActivity now calls window.setHideOverlayWindows(true) in onCreate, and the HIDE_OVERLAY_WINDOWS permission is added to the manifest, so that other apps' non-system overlay windows cannot be drawn over the Contacts Picker UI.
• CVE-2026-28631 · platform/frameworks/base
  Adds getWindow().setHideOverlayWindows(true) to the mini resolver consent dialog that IntentForwarderActivity shows before redirecting an intent into the managed profile, so overlay windows are hidden over the consent UI. A companion commit moves the executor and device-provisioned lookups behind the Injector so the activity test can run.
• CVE-2026-28633 · platform/frameworks/base
  In safe mode, VoiceInteractionManagerService no longer parses the recognition service metadata of third-party (non-FLAG_SYSTEM) recognizers in RecognitionServiceInfo.getAvailableServices, nor the metadata of the already-configured current recognizer, to prevent a malicious large metadata file from causing boot issues (OOM) in safe mode.
• CVE-2026-28634 · platform/packages/services/Telephony
  Adds a check to PhoneInterfaceManager.handleUssdRequest that the calling user is associated with the subscription. A caller that passes enforceCallPermission can no longer send USSD requests on a subscription that is not associated with its user.
• CVE-2026-28638 · platform/packages/providers/MediaProvider
  MediaProvider's XMP redaction for ISO (MP4-style) media is extended to redact EXIF GPS fields stored as XML attributes (not only as element names) and, on Android 14, to process every XMP box in the container rather than only the first one.
• CVE-2026-28639 · platform/system/nfc (libnfc-nci)
  In rw_mfc_handle_read_op (MIFARE Classic NDEF read handling), the else branch that logs SafetyNet ID 178725766 for an NDEF length inflation attempt now also sets failed = true, so the read operation is marked as failed instead of continuing. Per the commit message, this prevents a heap out-of-bounds write.
• CVE-2026-28642 · platform/frameworks/base
  In ActivityStarter, when the Background Activity Launch (BAL) check returns a blocking verdict, the fix clears the mLaunchTaskBehind flag on the newly built ActivityRecord so a blocked background start does not perform the launch-behind animation that would make the activity visible.
• CVE-2026-28644 · platform/frameworks/base
  ActivityTaskManagerService.startNextMatchingActivity() now forwards the original caller's identity (launchedFromUid/launchedFromPackage/launchedFromFeatureId) to the next resolved activity only when the intermediary activity shares the original caller's app ID or runs as SYSTEM_UID; otherwise the calling UID and package are reset to the intermediary's own.
• CVE-2026-28650 · platform/frameworks/base
  WindowState.setHiddenWhileSuspended now checks the window's base type (getBaseType()) instead of its own mAttrs.type. As a result, sub-windows whose top parent is a system alert window or toast of a suspended app are hidden, and later shown again, like their parent.
• CVE-2026-28652 · platform/packages/modules/Uwb
  Adds enforceRangingPermission() to five out-of-band (OOB) ranging Binder entry points in RangingServiceImpl (oobDataReceived, deviceOobDisconnected, deviceOobReconnected, deviceOobClosed, registerOobSendDataListener). Before the fix these methods passed calls to RangingServiceManager without any permission check.
• CVE-2026-28653 · platform/system/nfc (Android 14/15) and platform/packages/modules/Nfc libnfc-nci (Android 16/17)
  Adds a range check before the loop in rw_t3t_send_next_ndef_update_cmd and rw_t3t_send_next_ndef_check_cmd (src/nfc/tags/rw_t3t.cc). The first block number plus the block count can no longer go past the 16-bit range, where the commit says the uint16 block_id loop counter could wrap and cause an unbounded heap out-of-bounds write.
• CVE-2026-28655 · platform/frameworks/base
  Reworks RemoteViews parceling so that a single ApplicationInfoCache (typed list) is written once by the root RemoteViews and nested RemoteViews reference it by int id, and removes the Parcel.allowSquashing()/restoreAllowSquashing() wrapping of RemoteViews.writeToParcel together with the ALTERNATIVE_DEFAULT ReadWriteHelper trick that forced immediate (non-lazy) Bundle unparceling in ReflectionAction.
• CVE-2026-28656 · platform/frameworks/base (services/autofill UI: AutoFillUI
  Replaces the AppOps user-restriction based overlay suppression (OP_SYSTEM_ALERT_WINDOW / OP_TOAST_WINDOW toggled on show/hide or resume/pause) with the window-level Window#setHideOverlayWindows(true) / SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS flag. The change covers the autofill UI (FillUi, SaveUi, DialogFillUi) and the DeviceAdminAdd screens in Settings, Car Settings and TvSettings.
• CVE-2026-28657 · platform/frameworks/base
  AppWidgetConfigActivityProxy.onActivityResult now forwards only the extras of the configuration activity's result Intent (via a fresh Intent().putExtras(data)) instead of the original Intent. URI permission grant flags and the data URI from the widget provider are therefore no longer relayed through the system-privileged proxy's setResult().
• CVE-2026-28658 · platform/frameworks/base
  AccountsDb.findMetaAuthUid now strips the fixed "auth_uid_for_type:" prefix from the meta_key by length instead of splitting on ":" and taking the second token, so authenticator types containing a colon are no longer truncated when the type-to-UID map is built.
• CVE-2026-28660 · platform/frameworks/base
  Adds a PackageInstallerService.getAllSessions(userId, filterCallingUid) overload and makes LauncherAppsService.getAllSessions pass the real caller UID into it. SessionInfo objects returned through LauncherApps.getAllPackageInstallerSessions() are therefore generated and filtered for the actual caller instead of for system_server.
• CVE-2026-28662 · platform/external/wpa_supplicant_8
  Adds a bounds check in p2p_process_prov_disc_bootstrap_req (src/p2p/p2p_pd.c) that rejects a P2P2 PBMA comeback cookie longer than the fixed-size dev->bootstrap_params->cookie buffer, and enables the UBSan "bounds" sanitizer on a wpa_supplicant cc_library in wpa_supplicant/Android.bp.
• CVE-2026-28663 · platform/frameworks/base
  LauncherAppsService.buildIntentSenderForUser now passes ActivityOptions with PendingIntentCreatorBackgroundActivityStartMode set to MODE_BACKGROUND_ACTIVITY_START_ALLOW_IF_VISIBLE when it creates the system-owned PendingIntent that getAppMarketActivityIntent returns. The creator's background-activity-start privilege therefore no longer applies when the app sending the IntentSender is not visible.
• CVE-2026-28664 · platform/art
  In platform/art, RuntimeImage::WriteImageToDisk now calls fchmod() to set the newly created runtime-generated app image (.art) file to 0444 right after creation, and fails image generation if that call fails.
• CVE-2026-28668 · platform/bionic
  Removes the LimitFree(old_mem) call in bionic's LimitRealloc so that when a growing realloc is rejected by the Android allocation limit the original pointer is left untouched instead of being freed while the caller still holds it.
• CVE-2026-28671 · platform/packages/providers/MediaProvider
  MediaProvider.updateInternal's file-movement path now checks, before Os.rename, whether a database row already claims the destination _data path. If no file backs that row it deletes the row; if a file exists it enforces write permission on the row. The SQLiteConstraintException handler in updateAllowingReplace now deletes a conflicting row at the active rename destination and retries the update in the same transaction.
• CVE-2026-33636 · platform/external/libpng
  Restricts the NEON palette-expansion loops in external/libpng arm/palette_neon_intrinsics.c to full chunks only (loop condition i + pixels_per_chunk <= row_width), drops the post-loop count correction, and undoes the *ddp pre-adjustment before handing the remaining pixels to the scalar fallback.
• CVE-2026-45515 · platform/packages/modules/Bluetooth
  Passes the correct frame_size (the number of samples per channel the output buffer can hold, A2DP_OPUS_DECODE_BUFFER_LENGTH / (A2DP_OPUS_CODEC_OUTPUT_CHS * sizeof(int16_t))) to both opus_decode() calls in a2dp_vendor_opus_decoder_decode_packet instead of the buffer size in bytes. It also adds a channel-count check, removes the per-frame re-decode loop and makes frame_len use the configured stereo output.
• CVE-2026-45517 · platform/packages/providers/MediaProvider
  Adds structural checks (scheme, authority, picker path pattern) and a current-user-id check to caller-supplied preselection URIs in PickerUriResolver.processUrisForSelection, ahead of the per-URI permission check, so malformed, foreign-authority or cross-user URIs are dropped before their ids reach the picker query.
• CVE-2026-45518 · platform/frameworks/base (core/java/android/database/sqlite/SQLiteTokenizer) and platform/packages/providers/ContactsProvider (com.android.providers.contacts.util.SelectionBuilder)
  Adds an OPTION_CHECK_BRACKETS mode to android.database.sqlite.SQLiteTokenizer that rejects SQL fragments with unbalanced parentheses, and makes ContactsProvider's SelectionBuilder.addClause() validate every clause with it so a caller-supplied selection cannot close the parentheses that SelectionBuilder wraps around each clause.
• CVE-2026-45519 · platform/packages/providers/MediaProvider
  Adds structural, scheme, authority and user-ID validation of caller-supplied photopicker preselection URIs (EXTRA_PICKER_PRE_SELECTION_URIS) in PickerUriResolver.processUrisForSelection before they are used to build the picker database query.
• CVE-2026-45520 · platform/packages/apps/Settings
  BiometricsSettingsBase now honors the EXTRA_USER_ID and gatekeeper password handle (EXTRA_KEY_GK_PW_HANDLE) intent extras only when the hosting SettingsActivity was launched by the Settings package itself. Otherwise it uses the current user and ignores the handle, so the device credential confirmation flow is enforced.
• CVE-2026-45521 · platform/frameworks/base
  StorageManagerService.openProxyFileDescriptor now captures Binder.getCallingUid() and AppFuseBridge.openFile rejects the request unless the calling UID equals the uid recorded in the AppFuse MountScope for the requested mountId, preventing cross-app access to another app's AppFuse proxy file descriptors.
• CVE-2026-45525 · platform/packages/providers/MediaProvider
  Makes MediaProvider's ISO/MP4 parser keep parsing when an XMP box is too large to load. It also makes the XMP redaction logic redact the whole XMP byte range, instead of nothing, when the XMP payload could not be loaded, so location metadata is no longer left unredacted for oversized XMP boxes.
• CVE-2026-45527 · platform/frameworks/av
  In the MP4/HEIF extractor, convertCleanApertureToRect() now checks the crop rectangle bounds with int64_t arithmetic before computing right/bottom, so crafted CleanAperture values can no longer trigger a signed int32 overflow (IntSan abort) in media.extractor.
• CVE-2026-45528 · platform/frameworks/base
  StorageManagerService.getManageSpaceActivityIntent now builds the returned PendingIntent through ActivityManagerInternal.getPendingIntentActivityAsApp with the target package name and appInfo.uid instead of calling PendingIntent.getActivity on a package context created inside system_server with the calling identity cleared.
• CVE-2026-45529 · platform/packages/providers/TelephonyProvider
  MmsSmsProvider.query() now restricts the simple-conversations, conversation recipients/subject, search and searchSuggest URI paths to messages whose sub_id belongs to the calling user's subscriptions, returning an empty cursor when the user has no associated subscriptions.
• CVE-2026-45531 · platform/external/exfatprogs
  Hardens fsck.exfat boot-sector validation in read_boot_region() against integer overflow and underflow from the on-disk vol_length, clu_offset and clu_count fields, and makes the shared DIV_ROUND_UP macro compute in 64-bit.
• CVE-2026-49879 · platform/system/nfc (Android 14/15) and platform/packages/modules/Nfc libnfc-nci (Android 16/17)
  Widens block_id to uint32_t and recomputes the block-range bounds checks and loop limits in uint32_t in rw_t3t_send_next_ndef_update_cmd and rw_t3t_send_next_ndef_check_cmd (Type 3 Tag NDEF update/check), and frees the GKI command buffer when the bounds check fails.
• CVE-2026-49881 · platform/packages/services/Telecomm (InCallController) and platform/frameworks/base (core/res/AndroidManifest.xml)
  Removes InCallController.serviceClassExists and the 'android.telecom.CLASS_EXISTENCE_CHECK' metadata check from Telecom. That code loaded a third-party package's code inside Telecom during InCallService enumeration (CONTEXT_INCLUDE_CODE | CONTEXT_IGNORE_SECURITY, then getClassLoader and Class.forName). The fix also drops the now-unused metadata from ConnectivityCallListenerService in the framework manifest.
• CVE-2026-49882 · NFC tag reader/writer
  In rw_mfc_handle_read_op (Mifare Classic reader in the NFC stack), the fix saves ndef_length and ndef_start_pos just before rw_nfc_decodeTlv on the first block read. It then treats a decode failure, or any growth of ndef_length, as a failure and restores both fields, so an inflated length no longer stays in the control block where it bounds the copy into p_ndef_buffer.
• CVE-2026-49884 · platform/system/nfc (Android 14/15) and platform/packages/modules/Nfc libnfc-nci (Android 16/17)
  In rw_mfc_handle_read_op (Mifare Classic NDEF read), the fix snapshots p_mfc->ndef_length and p_mfc->ndef_start_pos before rw_nfc_decodeTlv, treats an inflated ndef_length as a failure, and rolls both fields back to their pre-decode values. This keeps the inflated length out of the control block.
• CVE-2026-49887 · platform/frameworks/base
  Fixes an inverted boolean in PackageInstaller v2's InstallRepository.maybeRemoveInvalidInstallerPackageName so that a mismatching EXTRA_INSTALLER_PACKAGE_NAME is stripped when the caller lacks INSTALL_PACKAGES, rather than when it holds it.
• CVE-2026-49895 · platform/external/wpa_supplicant_8
  Raises the EHT Operation element minimum-length constant in src/common/ieee802_11_defs.h from 1 to 5 so the length check used by get_eht_operation_channel_width() accounts for the fixed-size fields that precede the EHT Operation Information field.
• CVE-2026-49913 · platform/hardware/interfaces
  In the default AIDL CAS HAL, DescramblerImpl::descramble now compares the mmap() result for the client-supplied source SharedBuffer against MAP_FAILED instead of NULL, and installs a ScopeGuard that munmap()s the mapping on every exit path after the check.
• CVE-2026-49918 · platform/external/libcupsfilters
  Adds 64-bit overflow checks to the cupsBytesPerLine and line/page buffer size computations in libcupsfilters (imagetoraster.c, pwgtoraster.c, raster.c) so that large raster dimensions no longer wrap to undersized heap allocations.
• CVE-2026-49919 · platform/external/freetype
  Replaces an unchecked `size = rows * pitch; FT_ALLOC(buf, size)` in tt_face_colr_blend_layer (src/sfnt/ttcolr.c) with FT_ALLOC_MULT(buf, rows, pitch), so the FreeType memory layer detects the multiplication overflow instead of the code allocating an undersized buffer.
• CVE-2026-49921 · platform/packages/modules/Bluetooth
  Replaces the fixed 400-byte (SDP_MAX_ATTR_LEN) heap buffer in sdpu_build_partial_attrib_entry with an allocation sized to the serialized attribute. It also rejects attributes whose payload exceeds SDP_MAX_ATTR_LEN in that helper, in both SDP server request handlers and at database insertion, and adds an offset-vs-length check before the partial memcpy.
• CVE-2026-49926 · platform/external/libjxl
  Removes `integer_overflow: true` from the sanitize block of the `libjxl` cc_library in external/libjxl Android.bp, so that unsigned integer wrap-around that upstream libjxl uses on purpose no longer triggers UBSan aborts.
• CVE-2026-49927 · platform/external/libppd
  Adds 64-bit overflow checks when ppdRasterInterpretPPD derives cupsBytesPerLine. In write_flate it rejects cupsBytesPerLine*6 above INT32_MAX and replaces the header-sized stack VLAs and per-line mallocs with single checked heap allocations, freed through a common cleanup path.
• CVE-2026-49932 · platform/frameworks/base
  Hardens PduParser.parseParts in frameworks/base telephony/common so malformed MMS multipart PDUs are rejected (parse returns null) instead of causing OutOfMemoryError, StackOverflowError, NullPointerException or ArrayIndexOutOfBoundsException. It rejects a declared part dataLength larger than the bytes left in the stream, caps recursion into multipart/vnd.wap.multipart.alternative parts at depth 30, and checks that the nested result is non-null and non-empty before taking its first part.
• CVE-2026-55256 · platform/frameworks/base
  Adds null checks in PduParser.parsePartHeaders so that a null Content-Disposition token-text value, a null filename parameter, or a null custom text header name or value is no longer passed on or dereferenced, which prevents NullPointerExceptions while parsing an MMS PDU.
• CVE-2026-55273 · platform/frameworks/base
  aapt2's AnnotationProcessor now rewrites Javadoc terminators ("*/") and Java Unicode escape introducers ("\u") in resource XML comments before emitting them into the Javadoc blocks of generated R.java, so a comment can no longer close the Javadoc block and inject Java source.
• CVE-2026-55277 · platform/packages/modules/Nfc
  Adds a bounds check in RoutingManager::checkUiccListenConfigNeeded so a new UICC listen configuration is only appended to mNfceeListenConfig.config when nb_config is below NFA_EE_MAX_EE_SUPPORTED, otherwise it logs an error and returns false.
• CVE-2026-55285 · platform/hardware/nxp/secure_element
  Adds a range check on the channel number the Secure Element returns in the MANAGE CHANNEL OPEN response, before that number is used as an index into mOpenedChannels. The check is added to the ten openLogicalChannel implementations the commit touches in the NXP secure_element HAL (pn8x 1.0/1.1, plus snxxx 1.0/1.1/1.2/aidl SecureElement and VirtualISO). The fix also makes pn8x closeChannel return immediately on an invalid channel number.
• CVE-2026-55290 · platform/frameworks/base
  ResStringPool::setTo in libandroidfw now checks stringsStart and stylesStart against the chunk size unconditionally. It also checks that the style-offset array (styleCount * 4 bytes) fits inside the data buffer and ends before stringsStart. This closes an out-of-bounds heap read in ResStringPool::styleAt.
• CVE-2026-55294 · platform/external/libhevc
  In libhevc's ihevcd_get_tu_data_size(), the tu_map part of the TU data size is now budgeted with num_tu (luma plus chroma TUs) instead of num_luma_tu, so the size matches the space the initialization logic consumes.
• CVE-2026-58822 · platform/external/freetype
  Adds early size guards to FreeType's LCD and LCD-vertical smooth rasterizer entry points (ft_smooth_raster_lcd, ft_smooth_raster_lcdv) so bitmaps whose width/3 or rows/3 exceed 0x7FFF are rejected with Raster_Overflow instead of producing truncated 16-bit span coordinates that drive an out-of-bounds write.
• CVE-2026-58823 · platform/hardware/st/nfc
  Adds length and array-capacity checks in stpropnci_process_std() of the ST NFC HAL, so that RF_NFCEE_DISCOVERY_REQ_NTF and NFCEE_MODE_SET_NTF messages from the NFC controller can no longer write past the fixed-size ee_info and active_nfcee_ids arrays in the global stpropnci_state.
• CVE-2026-58839 · platform/system/incremental_delivery
  Shrinks the stack-allocated read buffer in the static forEachLine() helper of incfs/MountRegistry.cpp from 128 KiB to 32 KiB, adds a compile-time maxLineLength template parameter with a static_assert against the buffer size, and marks the buffer __attribute__((uninitialized)).
• CVE-2026-58874 · platform/frameworks/opt/telephony (SmsController
  Adds the missing subscription-to-user association check to SmsController.sendStoredText and sendStoredMultipartText (frameworks/opt/telephony). When the calling user is not associated with the subscription, the send is rejected with RESULT_USER_NOT_ALLOWED. The fix also makes the destAddr parameter of TelephonyPermissions.checkSubscriptionAssociatedWithUser nullable (frameworks/base) so the new callers can pass a null address.

Bulletin revisions

• 2026-10-13: removed CVE-2026-28666 (bulletin version 1.3)

Method and limits

Fixes are found in the public android-security-* tags by the bug id in the commit message, then Change-Id and patch id against the bulletin's commit, then two probable matches checked by content. "No public code" means no fixing commit in the ingested tags of that major, not proof that no fix exists anywhere. When none of the code the bulletin's commit patches exists in a major (removed or reworked before its release), the CVE is shown as "patched code absent" instead. Vendor closed-source components and the kernel are out of scope.

Data for this page (JSON).