Google has published its Android security bulletin for October 2026, listing 25 vulnerabilities, seven of them rated critical. The bulletin, dated 5 October, says a phone with a security patch level of 2026-10-01 or later is protected against all of them. When an Android phone in Australia receives that update depends on its maker and, in some cases, its mobile provider.

What the bulletin fixes

Google rates the most severe issue as a critical vulnerability in Android’s System component that could allow a local escalation of privilege with no additional execution privileges needed. User interaction is not needed for it to be exploited. Google adds that its severity ratings assume the platform’s security mitigations have been turned off or bypassed. The bulletin does not say that any of the issues have been exploited.

The 25 vulnerabilities sit in two parts of Android: seven in the Framework and 18 in System. Of the seven critical issues, four are escalation of privilege flaws and three are denial of service flaws. The rest are rated high, including one remote code execution issue in the Wi-Fi component. The fixes are listed against Android 14, 15, 16 and 17.

Three of the issues, two in Wi-Fi and one in telephony, are in Project Mainline components, which Google can update through Google Play system updates rather than a full update from the phone maker. Google says it notifies its Android partners of the issues at least a month before publishing a bulletin.

When your phone gets it

Samsung. Samsung’s security updates page already lists its October 2026 maintenance release, which applies all seven critical fixes from Google’s bulletin along with Samsung’s own. Samsung says delivery times may vary by region and model.

Google Pixel. Google usually publishes a separate Pixel Update Bulletin for its own phones. When we checked on 6 October, the October edition had not yet been posted.

Other makers. Each manufacturer sets its own schedule. Phones that have reached the end of their support period will not get this update at all.

What to do

On Android, open Settings, then About phone and Android version, to see the security update date. Check for updates under Settings, System and Software updates, though the menu names differ between makers. The Google Play system update date is shown on the same screen and updates separately.

Google also points to Google Play Protect, which is on by default on phones with Google Mobile Services and warns about potentially harmful apps. It matters most if you install apps from outside Google Play.

If your phone’s security update date is many months old and no update arrives, check whether the model is still supported. Our guide to how long phones get security updates explains how to work out what support a phone has left.

Questions

What is the October 2026 Android security patch level?

2026-10-01. Google says a device on that patch level or later is protected against all the issues in the October bulletin.

How many vulnerabilities does the October bulletin fix?

It lists 25, seven rated critical and 18 rated high, across the Framework and System components of Android 14 to 17.

Has Samsung released the October update?

Samsung has published its October 2026 security maintenance release, which includes the seven critical fixes. Samsung says delivery may vary by region and model.

How do I check my Android phone’s security update?

Open Settings, then About phone and Android version, and look at the Android security update date.

Sources