In short: On September 9, 2026, Google released the Android September 2026 security patch, fixing 180 CVEs across Android, Wear OS, Android XR, and Automotive OS. The headline flaw is CVE-2026-28662 — a critical memory corruption bug in the Wi-Fi subsystem that enables zero-click remote code execution: an attacker on the same Wi-Fi network can run arbitrary code on an unpatched device with no user interaction required. Full protection requires patch level 2026-09-05 or later.
What happened
Google published its September 2026 Android Security Bulletin on September 9, 2026, covering 180 vulnerabilities. The patch ships in two tiers: 2026-09-01 addresses 95 issues in Framework, System, Setup Wizard, and Project Mainline; 2026-09-05 adds 85 more in the Linux kernel and OEM components from Arm, MediaTek, and Qualcomm. Full protection is only guaranteed at patch level 2026-09-05 or later.
Among all 180 CVEs, the System component stands out with 56 flaws, 23 of which are rated Critical — including several Remote Code Execution (RCE), Elevation of Privilege (EoP), and Denial of Service (DoS) issues. Framework adds another 37 vulnerabilities, three rated Critical.
CVE-2026-28662: zero-click Wi-Fi attack — what it means in practice
CVE-2026-28662 is a Critical memory corruption flaw in Android's Wi-Fi subsystem. Attack vector: an attacker on the same Wi-Fi network can send a specially crafted packet and execute arbitrary code on a target device without any user interaction — no tap, no click, no opened file required.
The attack requires no privileges and no prior authentication. The only prerequisite: the victim is connected to the same wireless network. That makes the flaw particularly relevant in shared environments — cafés, airports, hotels, shopping centres — wherever people habitually join open or semi-open networks. Researchers at Jamf Security describe CVE-2026-28662 as a potential privilege escalation vector: after the initial code execution, an attacker may be able to escalate to full device control.
Scope: Android, Wear OS, Android XR, and Automotive OS
The September bulletin is not limited to phones and tablets. Google explicitly lists Wear OS (smartwatches), Android XR (mixed-reality headsets), and Android Automotive OS (in-vehicle infotainment systems) as covered platforms.
This matters for the Wi-Fi flaw: a smartwatch connected to a compromised network, or a car's infotainment unit with Wi-Fi support, could theoretically be at risk on unpatched firmware. Google's attack surface is broader than most users assume.
For Android smartphones, OEM vendors — Samsung, Xiaomi, OPPO, OnePlus, and others — must release their own OTA updates based on this bulletin. Flagship models typically receive patches quickly; budget and older devices may lag by weeks or receive no patch at all.
How to check your Android security patch level
Verifying your patch level is straightforward:
- Open Settings → About Phone → Software Information (path varies by manufacturer).
- Look for "Android Security Patch Level".
- If the date shown is 2026-09-05 or later, your device is protected against CVE-2026-28662 and all other September 2026 bulletin flaws.
- If the date is earlier, go to Settings → System Update and check for available updates.
If no update is available for your model yet, treat that as an active risk factor — especially on public Wi-Fi. For broader context on staying secure on an unpatched device, visit the LiMP VPN privacy blog. Regularly reviewing your device privacy settings is also worthwhile.
What a VPN does — and does not do — here
CVE-2026-28662 lives at the Wi-Fi chipset layer, below the OS network stack and below the application layer where a VPN operates. A VPN cannot block a chipset-level Wi-Fi attack directly. The only complete fix for CVE-2026-28662 is the security patch itself.
That said, a VPN adds a meaningful layer of defence against threats operating above the Wi-Fi layer: interception of unencrypted traffic, DNS spoofing, and man-in-the-middle attacks. Until your device is patched, minimising time on public Wi-Fi is the best mitigation. If public Wi-Fi is unavoidable, a VPN reduces the attack surface for everything above the chipset. The LiMP VPN app encrypts all connections under a strict no-logs policy; see pricing plans starting from $0.95/month.