Google’s October 2026 Android security bulletin fixes 25 vulnerabilities, seven of them rated critical. Xiaomi began shipping the fixes on October 17, but so far only to 15 devices and not in every region. Owners do not have to wait for firmware to get some of the protection. Three of the October fixes are delivered through Google Play system updates, which can also reach phones not on Xiaomi’s first rollout list if they have Google services. Below is what the patch addresses, which devices get it first, how to check for the Google Play update, and what you risk by delaying.
What you need to know
- Google’s bulletin, published October 5, contains 25 fixes. Seven are rated critical and 18 are rated high.
- The most serious flaw lets a malicious app on the phone gain elevated system privileges. It does not need extra permissions or any action from the user.
- Xiaomi started rolling out the patch on October 17 to 15 devices. Twelve run HyperOS 4 and get it only in China. Three HyperOS 3 models are receiving it in Europe and Russia.
- Three fixes, for the telephony and Wi-Fi modules, arrive through Google Play system updates rather than Xiaomi firmware.
Critical vulnerabilities in HyperOS on Xiaomi devices
What the October Android bulletin fixes
Google’s October security bulletin was released on October 5. It lists 25 fixes: 7 in the Framework and 18 in the System component. Seven vulnerabilities received the highest severity rating, critical. The remaining 18 are rated high.
The most dangerous issue allows privilege escalation directly on the phone. Exploiting it requires no additional permissions and no interaction from the user. A malicious app only needs to be on the device.
Removing a malicious app on a Xiaomi phone
Exploited or not?
According to Google’s bulletin, there are no signs yet that attackers have exploited these flaws. Now that the fixes have been published, anyone who wants to can study the vulnerabilities.
The 15 devices getting the patch first
Xiaomi began distributing the October security patch on October 17. The first wave includes flagships, mid-range phones, REDMI and POCO models, and one tablet:
- Xiaomi 17, 17 Pro, 17 Pro Max, 17 Ultra and 17 Ultra Leica & Leitzphone;
- Xiaomi Pad 8 Pro;
- REDMI K100 Pro, K100 Pro Max and K90 Pro Max;
- POCO F8 Ultra, F9 Pro and F9 Ultra;
- REDMI 15, POCO M7 Plus and POCO M8s.
The first 12 devices run HyperOS 4 and receive the update only in China. The last three run HyperOS 3 and are already receiving the patch in Europe and Russia. The update adds no new features and no performance improvements. It contains bug and security fixes only.
Some protection comes through Google Play
Google delivers some fixes through Google Play system updates instead of manufacturer firmware. In October, three vulnerabilities in the telephony and Wi-Fi modules were fixed this way. Devices that are not on the list above can also receive these updates if they have Google services.
Here is how to install them on Xiaomi, REDMI and POCO phones. The English menu labels below are translations and may not match your device exactly:
- Open Settings.
- Go to the section for fingerprints, face data and device protection.
- Select Privacy.
- Tap Google Play system update.
- If an update is available, install it and restart the phone.
Installing a Google Play system update
The section name can vary between HyperOS versions. If you cannot find it, search the settings for “Google Play” or “System update.” Keep in mind that this route delivers only part of the October protection, the fixes Google ships through Play system updates.
What happens if you put off the update
An unpatched phone keeps working exactly as before. It shows no errors and no warnings, and that is where the danger lies. An unfixed critical vulnerability remains an open door for malicious apps. They would not need to ask you for extra permissions to gain higher privileges on the system.
People who install apps from outside official stores or download APK files from messaging apps face the most risk, because this is how malware most often gets onto phones. Owners of devices that no longer receive patches at all are in the worst position. If your phone still gets updates, install them without delay. Each patch closes one more open door.
