Android September Security Update Addresses a Large Batch of Vulnerabilities

Google's September Android security programme is continuing to work its way through the ecosystem after addressing a particularly large collection of vulnerabilities. The complete September 5 patch level covers roughly 180 CVEs, including several critical remote-code-execution issues. As always with Android, receiving the fix depends on the device manufacturer and sometimes the mobile carrier rather than Google alone.

Pixel devices are already receiving September patches through Android 17 QPR1, while other manufacturers are incorporating the bulletin into their own monthly or quarterly updates. Security patches rarely generate the excitement of a new phone launch, but their importance increases as smartphones store payment credentials, identity documents, private photos and work accounts.

Users should check the Android security patch level rather than assuming that having Android 17 automatically means every September fix is installed. Devices showing the September 5, 2026 patch level include both groups of fixes covered by Google's bulletin.