NewsCompaniesFlawsGuides
Get the app

Should you install Android’s June 2026 security update?

From Android updates, in the HARD wiki · Updated
This article is about one Android release. For the latest version, see Android updates.

No: install Android security update November 2026 instead. Android security update June 2026 is a security update Google released on 1 Jun 2026 for Android phones and tablets. It fixes 114 security flaws, 18 rated critical and 96 high by Google.[1] One of them is already being used in attacks.

It has since been replaced by Android security update September 2026, released 8 Sep 2026, which includes all of its fixes. If you’re on an older version, install that instead.

Should you update?

No: install Android security update November 2026 instead. Android security update November 2026 came out on 2 Nov 2026 and includes every fix in Android security update June 2026, so there’s no reason to stop at this one. Software Update offers the newest version your device can run.

Is Android security update June 2026 still safe?

Not any more. The 3 updates since, up to Android security update November 2026, fix 413 security flaws that Android security update June 2026 doesn’t, and each became public the day its fix shipped. Installing it is safe: get it only from your phone’s Settings, from your phone maker, never from a link in an email, text or pop-up.

What it fixes

Google lists 114 security flaws, 18 rated critical and 96 high by Google.[1] The 114 critical and high ones are:

FlawSeverityWhat Google calls it
CVE-2025-65018CriticalFramework: EoP
CVE-2025-64720CriticalFramework: DoS
CVE-2026-0043CriticalSystem: EoP
CVE-2026-0097CriticalSystem: EoP
CVE-2026-21352CriticalSystem: EoP
CVE-2026-21353CriticalSystem: EoP
CVE-2025-64505CriticalSystem: DoS
CVE-2026-0039CriticalSystem: DoS
CVE-2026-0040CriticalSystem: DoS
CVE-2026-0041CriticalSystem: DoS
CVE-2026-0042CriticalSystem: DoS
CVE-2026-0044CriticalSystem: DoS
CVE-2026-0051CriticalSystem: DoS
CVE-2026-0052CriticalSystem: DoS
CVE-2026-0080CriticalSystem: DoS
CVE-2025-47392CriticalQualcomm closed-source components, Closed-source component:
CVE-2026-25276CriticalQualcomm closed-source components, Closed-source component:
CVE-2026-25277CriticalQualcomm closed-source components, Closed-source component:
CVE-2025-48570HighFramework: EoP
CVE-2025-48595HighFramework: EoP
CVE-2025-48615HighFramework: EoP
CVE-2025-48649HighFramework: EoP
CVE-2025-48652HighFramework: EoP
CVE-2026-0009HighFramework: EoP
CVE-2026-0046HighFramework: EoP
CVE-2026-0048HighFramework: EoP
CVE-2026-0055HighFramework: EoP
CVE-2026-0061HighFramework: EoP
CVE-2026-0076HighFramework: EoP
CVE-2026-0077HighFramework: EoP
and 84 more

Used in attacks

This fix closes a flaw that attackers were already using before the update came out, either on CISA’s list of flaws being used in attacks or in Google’s own words.[2]

How to update, and how long it takes

10 to 30 minutes, with one restart.

  1. Open Settings → Security & privacy → System & updates.On many phones it’s Settings → Software update, or Settings → System → System update instead; the words vary by phone maker.
  2. Install the security update and Google Play system update.Both can be waiting. Tap each one, download it and let the phone restart.
  3. Check when your phone gets updates.Your phone maker decides when the month’s fixes arrive, often weeks after Google publishes them. A phone that no longer gets updates stays open to every fix after its last one.

To check it worked: Settings → About phone → Android version shows the “Android security update” date. It should say 2026-09-05 or later.

Before and after

References

  1. ^ Google. “Android Security Bulletin, June 2026”, 1 Jun 2026.
  2. ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”.