October 2026 Android security update: applied October 8

Summary

Google's October 2026 Android Security Bulletin fixes 25 vulnerabilities in Android's framework and system components, at security patch level 2026-10-01. We merged the fixes into the Foundation OS on October 8, 2026, the day Google published the source, and built and tested them the same day. Every Foundation OS release since then includes them.

There were no kernel or chip-vendor fixes in this month's bulletin. Google reports no exploitation of any of these issues, and we have no evidence that any were exploited on OhrTech devices.

Fixed, in code that runs on OhrTech devices (16)

• Bluetooth: CVE-2026-55269, CVE-2026-58835 and CVE-2026-58880 (Critical, escalation of privilege); CVE-2026-49933 (Critical, denial of service)
• Framework: CVE-2026-58865 (Critical, denial of service); CVE-2026-58841 (High); CVE-2026-58834 (High)
• Media and camera: CVE-2026-58815 and CVE-2026-58856 (High)
• Telephony: CVE-2026-55270 and CVE-2026-58859 (High)
• Wi-Fi: CVE-2026-49878 and CVE-2026-45524 (High)
• System libraries: CVE-2026-45516 (FreeType), CVE-2026-49937 and CVE-2026-55279 (High)

Fixed, but not reachable on OhrTech devices (8)

We applied these fixes too, but the affected code cannot run on our devices:

• NFC: CVE-2026-55280 (Critical), CVE-2026-45513, CVE-2026-49880, CVE-2026-49885 and CVE-2026-28667. OhrTech devices have no NFC hardware, so the NFC service never runs.
• ST NFC driver: CVE-2026-55286. This driver is not part of the Foundation OS.
• Media tuner service: CVE-2026-58854. There is no tuner hardware, so the service never runs.
• libufdt: CVE-2026-55266. This is a build tool and does not run on the device.

Not independently verified (1)

CVE-2026-55265 (Critical, denial of service). Google has not published the source change for this issue, so we cannot confirm the fix in our own source. OhrTech devices are at security patch level 2026-10-01, which Google says addresses it.

Was anything exploitable on OhrTech devices?

Until the update, yes, potentially. The 16 issues in the first list were in code that runs on our devices, and four of them are critical Bluetooth flaws. Verified boot and SELinux limit what an attacker could gain from one of these bugs, but they do not make the bugs impossible to exploit. That is why the fixes went in as soon as Google published them.

We know of no exploitation of these issues on OhrTech devices, and Google's bulletin reports none.

Who needs to act

Nobody. The fixes are part of every Foundation OS release since October 8. If you approve updates manually, make sure your devices have taken the current release.