Android security tags, read closely by Lightrion

What the Android Security Bulletin does not tell you

If you maintain an Android fork, the monthly bulletin is where you learn what to patch. We read the public security tags of Android 14 to 17 commit by commit and joined them with every bulletin since late 2023. Five things stand out.

Many security fixes are in no bulletin

23%of the fix commits in the public security tags carry a bug id that no bulletin and no OSV advisory mentions (449 of 1912).
MajorTags readFixes for announced CVEs Fixes in no advisory
Android 14r1 to r3060299
Android 15r1 to r18424103
Android 16r1 to r9328190
Android 17r1 to r210957

Some are lower-severity fixes that bulletins do not list. Others become CVEs months later. A fork that picks only what the bulletin names misses them. Follow-ups of an announced CVE (their bug id is cited by the CVE's public commit) are not counted. Tags that carry a platform update rather than a security patch set are left out: android-security-14.0.0_r2 (597 commits), android-security-15.0.0_r5 (1412 commits).

Fixes are often public months before the CVE

105CVEs had the complete fix in a public security tag before the bulletin announced them: a median of 56 days earlier (up to 756).
CVEMajorsAnnouncedDays early
CVE-2023-40130142025-12-01756
CVE-2026-0026142026-03-01636
CVE-2024-0032142025-03-01390
CVE-2023-2402314, 152025-09-01363
CVE-2023-40122142025-02-01362
CVE-2024-0037142025-02-01362
CVE-2024-34739142025-05-01269
CVE-2025-2243214, 152025-12-01238
CVE-2026-0008162026-09-01183
CVE-2026-001014, 15, 162026-09-01183
CVE-2025-007614, 152025-09-01182
CVE-2025-4861614, 15, 162026-06-01182
CVE-2025-4854414, 15, 162026-03-01180
CVE-2024-49734152025-01-01120
CVE-2024-0024142024-05-01119

Measured from the tag where the fix is complete (its last commit) to the first bulletin listing the CVE: a conservative figure. Following the tags, rather than the bulletin, puts the fix in your tree earlier. It also means the code of a vulnerability is public before its advisory.

Some announced CVEs have no public code at all

CVE-2026-55265, Critical DoS, announced 2026-10-01
Android 14, 15, 16, 17: no fixing commit in the public security tags (platform/development, platform/frameworks/base).
CVE-2026-28609, High RCE, announced 2026-09-01
Android 14, 15, 16: no fixing commit in the public security tags (platform/frameworks/av).
CVE-2026-28636, High EoP, announced 2026-09-01
Android 14, 15, 16: no fixing commit in the public security tags (platform/packages/apps/DocumentsUI).
CVE-2025-48635, High EoP, announced 2026-03-01
Android 15: no fixing commit in the public security tags (platform/frameworks/base).

These are listed as affecting the majors above, yet no public security tag of those majors contains a fix. Partners get patches ahead of the bulletin; the public tree may never get them.

The bulletin links one branch, and OSV's commits are not public

A bulletin entry links at most one public commit, on the latest major's branch. OSV lists a commit per version, but for Android 15, 16 and 17 those commits are almost never reachable in the public repositories (measured on 2026-09-30: 0 to 6% public; for 14, they point to trunk commits, not to the security tag lineage). The only reliable bridge from a CVE to the public commit of an older major is the bug id in the commit message, and it is sometimes missing: hand backports drop the Bug line, change the bug id, or land through a merge.

Bulletins change after publication

Revisions add AOSP links, and sometimes add or remove CVEs. OSV reflects the current version only, so a removal leaves no trace there. We snapshot every bulletin since 2026-09-30 to record these changes.

Monthly pages