Google’s October 2026 Android Security Bulletin lists 25 vulnerabilities fixed at security patch level 2026-10-01, and a separate Pixel bulletin adds six more for Google’s own phones. The update reaches every model from the Pixel 6 through the Pixel 11 Pro Fold, a span of six hardware generations that includes the Pixel Tablet and the original Pixel Fold. 9to5Google’s Abner Li reported the rollout on Oct. 6.
Alongside the security work, the changelog lists three ordinary bug fixes: a keyboard that sometimes failed to appear in search fields, distorted ringtones during certain internet calls, and photos or videos saved in the wrong orientation.
Twenty-five Android CVEs, seven of them critical
Google published the October 2026 Android Security Bulletin on Oct. 5 and revised it on Oct. 8 to add source-code links. It splits the 25 entries between two components: seven in the Framework and 18 in System. One Framework flaw and six System flaws carry a critical rating, and the bulletin states that the most severe issue is a critical vulnerability in the System component. The remaining 18 are rated high. The bulletin makes no claim that any of the flaws were exploited in the wild, and it describes each one only by type, severity and component.
The critical Framework entry, CVE-2026-58865, is a remote denial of service that needs no extra privileges and no user interaction. The System criticals include local privilege escalation bugs in Bluetooth (CVE-2026-55269, CVE-2026-58835 and CVE-2026-58880) and in NFC (CVE-2026-55280), plus denial of service flaws in Bluetooth (CVE-2026-49933) and an unnamed System module (CVE-2026-55265). Devices at patch level 2026-10-01 or later address everything in the list.
The count differs from the figure in 9to5Google’s coverage, which put the Android total at 28 issues. The CVE tables in Google’s bulletin add up to 25, and the Google Play system updates section only repeats three identifiers already listed under System, so the bulletin’s own tally is the one used here.
Six more fixes in the Pixel bulletin
The Pixel Update Bulletin, published Oct. 6, covers six vulnerabilities in two components and says its patches come on top of those in the Android bulletin. Two are in the kernel, both rated high: CVE-2026-56906 in the file system and CVE-2026-56936 in the Wacom HID driver, each an elevation of privilege. Four are in Pixel components. The Bluetooth flaw CVE-2026-55330 and the GDMC flaw CVE-2026-56952 are critical privilege escalations, CVE-2026-55307 is a critical information disclosure in GSA, and CVE-2026-0198 is a high-rated information disclosure in GDMC.
That makes three critical and three high ratings across the six. The Pixel bulletin sets its patch level at 2026-10-05 or later and says all supported Pixel devices will be updated to it, with firmware images posted on Google’s developer site. It lists no components from Qualcomm or any other chipset vendor this month, which leaves the six fixes entirely in Google’s own kernel and Pixel code. As with the Android bulletin, the Pixel document gives only the table entry for each flaw, including the Bluetooth escalation bug it rates critical, and no narrative description of how an attacker could use it.
Four build numbers across the Pixel lineup
The update is not one file. According to 9to5Google, the Pixel 6, 6 Pro, 6a, 7, 7 Pro and 7a, plus the Pixel Tablet and Pixel Fold, receive build CP3A.261005.002.A1. The Pixel 8, 8 Pro, 8a, 9, 9 Pro, 9 Pro XL, 9 Pro Fold, 9a, 10, 10 Pro, 10 Pro XL, 10 Pro Fold and 10a share build CP3A.261005.005. The Pixel 11, 11 Pro, 11 Pro XL and 11 Pro Fold run CD1A.261005.003 globally, while the SoftBank variant of the Pixel 11 series uses CD1A.261005.003.B1. Owners can match a phone to its build in Google’s community changelog thread.
The release follows the September quarterly platform release for Android 17, which 9to5Google covered in its QPR1 article on Sept. 15. One reader, Thomas Hubert, used the comments on Li’s October post to ask when that QPR1 release would reach the Pixel 11 series. The article does not answer him, and it gives no rollout schedule beyond its own publication date.
The three non-security fixes each reach a different slice of the lineup. The keyboard repair applies to the Pixel 8 and newer, including the whole Pixel 11 series, so Pixel 6 and Pixel 7 owners get the security patches but not that correction. The ringtone distortion fix covers the Pixel 8 through Pixel 10a and excludes the Pixel 11 series, and the wrong-orientation fix for photos and videos applies only to the Pixel 11 series. Reading the notes model by model matters for that reason: a Pixel 9 owner and a Pixel 11 owner install the same month’s patch level but see different repairs.
For owners, the practical step is the ordinary one: check for the system update and compare the installed build string with the list above. Pixel 11 owners are left with the question Hubert raised, when QPR1 arrives for their phones, which neither 9to5Google nor Google’s bulletins answer.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- Ford is recalling 223,472 F-150 pickups because the fuel tank can leak or detach
- Hybrids have 15% fewer problems than gas cars, while EVs and plug-in hybrids have about 80% more, Consumer Reports finds
- Regulators cleared the first U.S. small modular reactor, 4 months early
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
