Android April 2026 Security Bulletin: CVE-2026-0049 DoS and StrongBox High Severity Vulnerabilities

Android Security Bulletin—April 2026 Vulnerability Key Information Summary 1. Vulnerability Overview This bulletin, published on April 6, 2026, addresses security vulnerabilities affecting Android devices. It includes two security patch levels (2026-04-01 and 2026-04-05) and details the associated CVE IDs, vulnerability types (e.g., DoS, High-severity vulnerabilities), and severity ratings. 2. Scope of Impact Framework: CVE-2026-0049: Type is DoS (Denial of Service), with a severity of Critical. Affected Versions: Android 14, 15, 16, and 16-qpr2. Description: This vulnerability may lead to a local denial of service and can be exploited without requiring additional execution privileges. StrongBox Components (Involving Multiple Vendors): CVE-2025-48651: Severity is High. Affected Components/Vendors: Google (Subcomponent: StrongBox) NXP components (Subcomponent: StrongBox) STMicroelectronics (Subcomponent: StrongBox) Thales (Subcomponent: StrongBox) Google Play system updates: No security issues reported for this month. 3. Remediation Update Security Patches: Users must update their devices to security patch level 2026-04-01 or 2026-04-05 to remediate the aforementioned vulnerabilities. Patch Level Identification: Device manufacturers must set the patch string level to or . Google Play system updates: For devices running Android 10 and above, Google Play system updates will include a date string matching the 2026-04-01 security patch level. 4. POC Code / Exploit Code The bulletin does not contain specific POC code or exploit code. It only provides reference links (References), such as (Android bug ID) and , among others.

Goal Reached Thanks to every supporter — we hit 100%!

Android April 2026 Security Bulletin: CVE-2026-0049 DoS and StrongBox High Severity Vulnerabilities