www.it-connect.fr
Android September 2026 Patch Fixes Critical Remote Code Execution Flaw
A flaw that allows remote code execution on an Android smartphone, with no special privileges and no action required from the user. That is how we can describe the most severe security issue patched in Android’s September 2026 update.
Google released its Android security bulletin for September 2026 on September 8, alongside Microsoft’s massive Patch Tuesday. As every month, the fixes are split across two patch levels: 2026-09-01 for the core of Android (runtime, Framework, System) and 2026-09-05, which adds the kernel and chip vendor components (Qualcomm, MediaTek, Unisoc, Arm, Imagination Technologies).
This month, Google reportedly fixed 180 vulnerabilities, including 32 critical security flaws. That is fairly high compared with previous months, but there is still some good news: Google does not mention any active exploitation. In other words, this time, no flaw is accompanied by the usual wording about “limited and targeted” exploitation.
Remote code execution without interaction
Even so, the opening sentence of this article suggests that there is a particularly dangerous security flaw in the batch. Indeed, there is, but I cannot tell you which one, because Google does not say.
The Mountain View company only states the following: "The most severe of these issues is a critical vulnerability in the System component that could lead to remote code execution with no additional execution privileges needed. User interaction is not required for exploitation."
The problem is that the System component alone includes eight critical RCE flaws in this bulletin: CVE-2026-28604, CVE-2026-28618, CVE-2026-28639, CVE-2026-28662, CVE-2026-49882, CVE-2026-49884, CVE-2026-49919, and CVE-2026-49921. Google does not specify which one is covered by its statement and provides no technical details, as usual. We do get a few clues for three flaws:
- CVE-2026-28604. It affects adbd, the Android Debug Bridge daemon.
- CVE-2026-28618. It involves media codecs, which could point to a flaw triggered by a malicious file.
- CVE-2026-28662. It is associated with the WiFi stack.
These three components are distributed through Google Play system updates, which means their fix can arrive without waiting for a full Android operating system update.
More than 40% of the Android installed base will never see this patch
A patch, no matter how important, is useless if it never reaches your device. In this case, more than 40% of Android devices may never receive this security update. Here is why. If we look at the stats file published by Google (this JSON file), and although the data stops at December 1, 2025, we get the following: Android 15 in the lead with 19.3%, ahead of Android 14 (17.2%), Android 13 (13.9%), Android 11 (13.7%), and Android 12 (11.4%). Android 16, meanwhile, topped out at 7.4%. Android 17 had not been released yet.
Even if these figures are a bit old, they show a trend. If you add them up, around 42% of active devices would still be running Android 12 or earlier, versions that no longer receive security updates.
And this September bulletin from Google drives the point home in a way: the updated AOSP versions range from 14 to 17. Android 13 is not included. Based on those same figures, Android 14, 15, and 16 together accounted for only 44% of the installed base. Those data are nine months old, I agree, and the share of Android 16 and 17 has certainly increased since then, but the order of magnitude remains the same: a good half of the installed base will not receive these fixes.
Even though Google Play Protect continues to work on older devices, it scans apps; it does not fix security vulnerabilities. The fragmentation across Android versions and the lack of follow-through from some manufacturers remain the perennial Android problem. Now, the ball is in the manufacturers’ court, and they will need to integrate these fixes into a future update.
