Google Patches 180 Android Flaws, Including a Wi-Fi Bug That Needs No Tap to Exploit
September 2026's Android security update is the largest in months. One flaw lets attackers run malicious code over Wi-Fi without the phone's owner doing anything.
Key points
- Google released patches for 180 Android security flaws on 2 September 2026, the platform's biggest update after two quiet months.
- The most dangerous flaw, CVE-2026-28662, sits in Android's Wi-Fi code and lets an attacker run software on your phone without any user interaction.
- 23 of the patched bugs are rated "critical" severity and live in Android's System component, which controls core phone functions.
- Phones showing a security patch level of 2026-09-05 or later contain fixes for every flaw listed in this bulletin.
- Wear OS, Android XR, and Android Automotive OS receive no separate patches this month but inherit all fixes through their normal updates.
Google has pushed its largest Android security update in months, closing 180 vulnerabilities across the Android operating system. A vulnerability is a software flaw attackers can exploit to break into or disrupt a device. The company published its September 2026 Android Security Bulletin on Tuesday after issuing no security fixes in July or August.
Why does the Wi-Fi bug matter most?
One flaw, CVE-2026-28662, stands out. It's a memory-corruption bug, where software mishandles data in a way that lets an outsider take control, hidden inside Android's Wi-Fi code. An attacker on the same network could silently run their own software on your phone without any tap, link click, or warning.
Adam Boynton, senior enterprise strategy manager at mobile-device security firm Jamf, called it the most concerning item on the list. "If left unpatched, it could enable attackers to execute code remotely, without any additional privileges or user interaction, potentially allowing privilege escalation," he told SecurityWeek. Privilege escalation means an attacker moves from limited access to full control of the device.
What exactly did Google fix?
The update ships in two parts.
| Patch level | Bugs fixed | Highest severity | Components covered |
|---|---|---|---|
| 2026-09-01 | 95 | Critical | System, Framework, Android Runtime, Setup Wizard, Mainline |
| 2026-09-05 | 85 | Critical | Kernel, Qualcomm, MediaTek, Arm, Unisoc, others |
The System component alone accounts for 56 fixes, 23 of them critical. Those bugs could allow remote code execution (RCE, meaning an outsider runs code on your device), elevation of privilege, or denial-of-service crashes. Framework, which governs how apps talk to Android, adds another 37 fixes including three critical ones. Devices updated to 2026-09-05 or later get everything from both parts.
Should ordinary Android users do anything?
Yes: check for an update and install it. On most Android phones, go to Settings, then About Phone, then Software Update. A security patch date of 2026-09-05 or later means you're covered.
Not every phone gets patches immediately. Manufacturers such as Samsung and Nokia test Google's fixes before pushing them to their own devices, which can add days or weeks. If your phone is several years old, a patch may never arrive.
Google hasn't said any of these 180 flaws are being actively exploited, as reported by SecurityWeek. That's some comfort, but the gap between a public patch and criminals reverse-engineering it to attack unpatched phones is typically short. Five days ago we reported on a Chrome V8 flaw that was already in active use before Google could push a fix, a reminder of how quickly that window can close. Update promptly.
