Android October Patches Fix 25 Flaws, 7 Critical

Google’s October 2026 Android security bulletin dropped Tuesday: 25 vulnerabilities patched, seven critical, no active exploitation reported. The number that keeps standing out, cycle after cycle, is the privilege escalation count.

Thirteen of the 25 fixes address elevation-of-privilege bugs. Seven sit in the System component, five in Framework. The most serious, a critical System flaw, enables local privilege escalation with no additional permissions required and no user interaction, per Google’s October 2026 security summary. System also carries one remote code execution bug and four information-disclosure issues; Framework adds two denial-of-service vulnerabilities. Three more issues ship via Google Play system updates.

Pixel owners get six additional fixes at the Pixel-specific patch level, three of them critical, covering Bluetooth, GDMC, and GSA. Android Automotive OS receives all of the above plus five more high-severity EoP patches.

The EoP density is worth pausing on. Local privilege escalation bugs rarely work alone: an attacker who lands an initial foothold in a sandboxed context, say through a malicious app or a browser exploit, needs something like these to cross into a higher-privilege tier. Google has been fighting this class of bug in Android’s system layers for years. The attack surface is large and distributed across components that device manufacturers then fork, delay patching, or skip entirely on older hardware. The bulletin covers Pixel and the Android Open Source Project; what reaches actual users depends on a supply chain that Google only partially controls.

“No evidence of active exploitation” is the standard language here, and it holds for now. The September Pixel update had a different story: a modem zero-day was already being exploited in attacks by the time Google disclosed it. October’s bulletin is cleaner. Whether it stays that way depends on how quickly patches reach the fragmented device base and how quickly researchers or threat actors find ways to chain these EoP bugs with something else.

Devices should reflect patch level 2026-10-01 or later under Settings > Security & Privacy > System update. Carrier and OEM updates typically roll out over the week after the bulletin.