Android
Product · by GoogleVulnerabilities
6 CVEs in our records, 0 known exploited (on CISA's KEV list).
Source: NVD and CISA KEVAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Affected versions
- CVE-2026-28586 from 14.0, up to 14.0
- CVE-2026-28586 from 16.0-qpr2_beta_3, up to 16.0-qpr2_beta_3
- CVE-2026-28586 from 16.0-qpr2_beta_2, up to 16.0-qpr2_beta_2
- CVE-2026-28586 from 16.0-qpr2_beta_1, up to 16.0-qpr2_beta_1
- CVE-2026-28586 from 16.0, up to 16.0
- CVE-2026-28586 from 15.0, up to 15.0
- CVE-2026-28580 from 16.0-qpr2_beta_1, up to 16.0-qpr2_beta_1
- CVE-2026-28580 from 16.0-qpr2_beta_3, up to 16.0-qpr2_beta_3
- CVE-2026-28580 from 16.0-qpr2_beta_2, up to 16.0-qpr2_beta_2
- CVE-2026-28580 from 16.0, up to 16.0
- CVE-2025-22426 from 16.0, up to 16.0
- CVE-2025-22426 from 14.0, up to 14.0
Security timeline
- Vulnerability reported by Cyber Security NewsZero-click 'SMS of Death' flaw lets one malformed text crash Android phone service
- Vulnerability reported by Cyber Security NewsAnthropic says its AI model built a working root exploit for critical Linux kernel flaw CVE-2026-98432
Recent news
Byoky: open-source wallet keeps AI API keys encrypted on the user's device
Byoky is an open-source wallet for AI API keys from OpenAI, Anthropic, Google Gemini and other providers, available as Chrome and Firefox extensions and as iOS and Android apps. Keys are encrypted on the user's device, and the wallet sends provider requests on behalf of apps, which receive only a session token while the key stays in the wallet.
Cheap Android car head unit found loaded with bloatware and spyware-like apps
A Civic owner bought a low-cost aftermarket Android head unit from Amazon and used Claude to analyse its firmware, as might be done with a smart TV. The unit shipped with a voice assistant using WebView that reportedly consumed about a third of processing power while idle, Baidu location services, a call recorder, a DAB radio client and Adobe Acrobat. Schneier notes that this illustrates the insecurity of IoT software and that AI is lowering the barrier to reverse engineering.
Columnist mocks Apple's foldable iPhone cracks and touch-screen laptop plans under new CEO John Ternus
An opinion column criticises Apple for launching a touch-screen laptop and for reports of cracking in its foldable iPhone, which the author calls the "iPhone Duo". The author describes Apple under new CEO John Ternus as relying on gimmicks and borrowing ideas from rivals, and argues that Apple's recent direction is struggling.
Zero-click 'SMS of Death' flaw lets one malformed text crash Android phone service
A zero-click Android flaw dubbed 'SMS of Death' lets an attacker crash the com.android.phone process with one malformed WAP Push message, dropping active calls and causing one to two seconds without service per message. Around 30 messages in quick succession can corrupt the SMS SQLite database, leaving the phone app crashing on every boot, and carrier retries of unacknowledged messages can re-trigger the problem after a factory reset. Google has marked the report 'Won't Fix' as a non-security issue, according to the researcher's disclosure site.
Anthropic says its AI model built a working root exploit for critical Linux kernel flaw CVE-2026-98432
Anthropic says an unreleased Claude research model produced a zero-click exploit for CVE-2026-98432, a use-after-free race condition in the Linux kernel's IPv4 TCP handling that gives unauthenticated root command execution, with a claimed 9.8 CVSS score. Upstream fixes are available in stable branches such as 5.10.272, 5.15.223 and 6.6.159, but distribution fixes are uneven, with Ubuntu and Red Hat Enterprise Linux reportedly lacking patched kernels as of 30 October. Teams should prioritise internet-facing servers, apply vendor kernel updates, reboot, and check whether multipath TCP listeners are needed.