NewsCompaniesFlawsGuides
Get the app

Should you install Android’s September 2026 security update?

From Android updates, in the HARD wiki · Updated
This article is about one Android release. For the latest version, see Android updates.

No: install Android security update November 2026 instead. Android security update September 2026 is a security update Google released on 8 Sep 2026 for Android phones and tablets. It fixes 172 security flaws, 28 rated critical and 144 high by Google.[1] None of them is known to be used in attacks.

It has since been replaced by Android security update October 2026, released 5 Oct 2026, which includes all of its fixes. If you’re on an older version, install that instead.

Should you update?

No: install Android security update November 2026 instead. Android security update November 2026 came out on 2 Nov 2026 and includes every fix in Android security update September 2026, so there’s no reason to stop at this one. Software Update offers the newest version your device can run.

Is Android security update September 2026 still safe?

Not any more. The 2 updates since, up to Android security update November 2026, fix 241 security flaws that Android security update September 2026 doesn’t, and each became public the day its fix shipped. Installing it is safe: get it only from your phone’s Settings, from your phone maker, never from a link in an email, text or pop-up.

What it fixes

Google lists 172 security flaws, 28 rated critical and 144 high by Google.[1] The 172 critical and high ones are:

FlawSeverityWhat Google calls it
CVE-2026-49932CriticalFramework: DoS
CVE-2026-28604CriticalSystem: RCE
CVE-2026-28618CriticalSystem: RCE
CVE-2026-28639CriticalSystem: RCE
CVE-2026-28662CriticalSystem: RCE
CVE-2026-49882CriticalSystem: RCE
CVE-2026-49884CriticalSystem: RCE
CVE-2026-49919CriticalSystem: RCE
CVE-2026-27280CriticalSystem: EoP
CVE-2026-28590CriticalSystem: EoP
CVE-2026-33636CriticalSystem: EoP
CVE-2026-45515CriticalSystem: EoP
CVE-2026-45531CriticalSystem: EoP
CVE-2026-49879CriticalSystem: EoP
CVE-2026-49918CriticalSystem: EoP
CVE-2026-49927CriticalSystem: EoP
CVE-2026-55277CriticalSystem: EoP
CVE-2026-55285CriticalSystem: EoP
CVE-2026-58823CriticalSystem: EoP
CVE-2026-28653CriticalSystem: DoS
CVE-2026-49926CriticalSystem: DoS
CVE-2026-55256CriticalSystem: DoS
CVE-2026-31629CriticalKernel, NFC: EoP
CVE-2026-58846CriticalKernel, Protected Kernel-Based Virtual Machine: EoP
CVE-2026-58848CriticalKernel, Protected Kernel-Based Virtual Machine: EoP
CVE-2026-58941CriticalKernel, Protected Kernel-Based Virtual Machine: EoP
CVE-2026-52993CriticalKernel components, Transparent Inter-Process Communication: RCE
CVE-2026-25289CriticalQualcomm closed-source components, Closed-source component:
CVE-2026-28664HighAndroid runtime: EoP
CVE-2026-28609HighFramework: RCE
and 142 more

How to update, and how long it takes

10 to 30 minutes, with one restart.

  1. Open Settings → Security & privacy → System & updates.On many phones it’s Settings → Software update, or Settings → System → System update instead; the words vary by phone maker.
  2. Install the security update and Google Play system update.Both can be waiting. Tap each one, download it and let the phone restart.
  3. Check when your phone gets updates.Your phone maker decides when the month’s fixes arrive, often weeks after Google publishes them. A phone that no longer gets updates stays open to every fix after its last one.

To check it worked: Settings → About phone → Android version shows the “Android security update” date. It should say 2026-10-01 or later.

2026-06-05 vs 2026-09-05

Android security update June 2026, released 1 Jun 2026, fixed 114 security flaws, one already used in attacks. Android security update September 2026 fixes 172 security flaws and includes the fixes before it, so going straight to 2026-09-05 gets you both.

References

  1. ^ Google. “Android Security Bulletin, September 2026”, 8 Sep 2026.