Android Security Bulletin — September 2026
Monday, 7 September 2026
Exploited 0
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
None of this release's vulnerabilities is known to be exploited so far.
Critical 5
- Critical 10.0
- Critical 10.0
- Critical 9.8
- Critical 9.8
- Critical 9.8
Public exploit code 3
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
- High 8.8
- High 8.8
- High 7.8
All vulnerabilities 90
Critical5 ShowHide
- Critical 10.0
- Critical 10.0
- Critical 9.8
- Critical 9.8
- Critical 9.8
High64 ShowHide
- High 8.8
- High 8.8
- High 8.8
- High 8.8
- High 8.8
- High 8.0
- High 8.0
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.5
- High 7.3
- High 7.3
- High 7.3
- High 7.3
- High 7.0
Medium7 ShowHide
- Medium 6.5
- Medium 5.5
- Medium 5.5
- Medium 5.5
- Medium 5.5
- Medium 4.3
- Medium 4.3
Low14 ShowHide
- Low 3.5
- Low 3.3
- Low 3.3
- Low 3.3
- Low 3.3
- Low 3.3
- Low 3.3
- Low 3.3
- Low 3.3
- Low 3.3
- Low 3.3
- Low 3.3
- Low 3.3
- Low 3.1