Android’s patch level: how to read a security bulletin

A bulletin is a dated list, not a threat report

Each entry names a component, a severity and the patch level at which a phone carries the fix. The patch level is a date. The March 2026 Qualcomm display fix sits at 2026-03-05, and the June 2026 framework fix at 2026-06-01 [S1][S2]. A phone whose patch level is earlier than the date of a fix does not have that fix.

A bulletin does not name victims, attackers or indicators of compromise. It is a maker’s statement about what has been repaired and, occasionally, what it believes was used before the repair.

The four sets Google flagged

December 2025. Two framework flaws: CVE-2025-48633, an information disclosure, and CVE-2025-48572, a privilege escalation. CISA added both to its Known Exploited Vulnerabilities catalog on 2 and 3 December, Help Net Security reported[S4].

March 2026. CVE-2026-21385, a high-severity flaw in a Qualcomm display component, fixed at patch level 2026-03-05. Google’s Android Security team reported it to Qualcomm in December 2025, about three months before the fix appeared in the bulletin[S1].

June 2026. CVE-2025-48595, a high-severity framework privilege escalation affecting Android 14 through 16 QPR2, fixed at 2026-06-01[S2].

September 2026. In the separate Pixel bulletin, CVE-2026-58704, a high-severity flaw in the cellular modem[S3].

The other months were quiet. According to Google’s monthly pages, the main bulletins for January, February, April, May, July, September and October flagged nothing, and February and July listed no vulnerabilities at all[S5]. We could not read the vulnerability table of the August 2026 bulletin, so we make no statement about it.

Our assessment: what "limited, targeted" tells you

Our assessment is that the phrase is most plainly read as a narrow factual statement and nothing more. It says Google has reason to think someone used the flaw before the fix. It does not say who, against whom, how many people, or whether a given phone was touched. The press often turns it into "zero-day"; the bulletin does not, and we keep to Google’s wording.

Every flagged flaw above is a local one: it helps someone who already runs code on a phone to gain more control. That fits the pattern Google’s threat intelligence group describes for 2025, when multiple exploit chains used three or more vulnerabilities[S6]. A flagged entry is usually a later link, not the whole attack.

Severity is a separate question. The March 2026 bulletin also fixed CVE-2026-0006, a critical flaw in media codecs on Android 16 that, by the bulletin’s conditions, needs no user interaction and arrives through a Google Play system update. The bulletin does not say it was exploited[S1]. Google’s Project Zero showed in October 2025 that a flaw in Dolby audio decoding (CVE-2025-54957) could give code execution on a Pixel 9 with no user action. It has since been fixed, and no exploitation in the wild was reported[S7]. Critical and exploited are different columns, and a careful reader keeps them apart.

Bugs that need an app first

Two talks at the Hexacon conference in Paris on 17 October 2026 concern flaws that a malicious app, rather than a message or web page, would use[S8].

A researcher from Calif.io presented chained flaws in Samsung’s DualDAR, a Knox feature that adds a second encryption layer. The abstract says the chain takes an app with no permissions to root on recent Galaxy S26 phones, and that the same code appears from the S23 through the S26 and the Z Fold7[S8]. Samsung’s September 2026 bulletin lists two DualDAR flaws, CVE-2026-21101 and CVE-2026-21102, rated Moderate and credited to the same researcher[S9]. We have not established that the talk’s chain is exactly those two entries and do not claim it. No exploitation in the wild was reported.

Two Google engineers spoke about Parcel, the mechanism Android uses to pass data between processes. Android 13 hardened it against a class of "mismatch" bugs that earlier real-world attacks relied on, but fixing one leak created a use-after-free; three such exploits reported through Google’s reward program could steal binder tokens and reach code execution, the abstract says[S8]. One CVE it lists, CVE-2025-48583, is a high-severity framework flaw fixed for Android 14 to 16 in the December 2025 bulletin and not flagged as exploited[S10].

A third talk, from KAIST researchers, concerns memory tagging, a hardware feature of recent Arm processors. In its asynchronous mode a tag error is reported shortly after the faulting access. The abstract says that short window can be used to interfere with the kernel’s fault handling before the violation is processed, shown against two real Linux kernel flaws it does not name[S8]. It is technique research. Apple’s memory-tagging design is different, and a separate article in this series covers it.

Why one phone is patched and another is not

A fix travels. The Qualcomm display flaw went from Google to the chip maker and then into a bulletin. Android’s own bulletin, a separate Pixel bulletin and a Samsung bulletin each carry their own dates [S1][S3][S9]. Two phones on the same Android version can therefore sit at different patch levels, and the date, not the version number, is what to compare.

The CISA catalog adds a second view. It lists 17 entries under the vendor label Android, plus one for Chrome for Android UI, added 3, 3, 2, 6, 3 and 1 times across 2021 to October 2026[S11]. Flaws that affect many Android phones also sit under Qualcomm (12 entries), Samsung (15), Arm (9) and Chromium (65), not all of them mobile-only[S11]. The date an entry is added is not the date of exploitation, and the bulletin flags and the catalog do not line up one to one.

What the Lab is watching

We are watching three things. First, whether the August 2026 bulletin, which we could not read, changes the count above. Second, whether Samsung’s October and November bulletins carry further DualDAR or Parcel-class entries. Third, whether the Hexacon abstracts turn into published write-ups with CVE numbers, which would let the mapping we decline to make today be checked rather than guessed.

What this means for examiners

For the owner of a phone, the practical step is small: open the settings, find the Android security update date, compare it with the latest bulletin for that make, and install updates when offered.

For examiners and consultancies, note the patch level at acquisition and write it beside the bulletin date of any fix in question. An update changes what the phone shows about itself, so record the level before updating.

How it reaches a phone and what it leaves, for the flagged class: propagation is local, so a first stage such as an app or a message comes first; the format is usually an app or file, which a bulletin never describes; traces are often few; and the phone’s own logs rotate.

Five questions for any bulletin line

1. Which component is affected, and is it Android, Pixel or the phone maker’s own bulletin?
2. How severe does Google rate it?
3. Does the line carry the "limited, targeted exploitation" wording, or only a severity?
4. Which patch level carries the fix?
5. What date does your phone show?

Answer those five and a headline becomes a fact you can use.