InfoSecBulletin Cybersecurity for mankind
Google has shared its Android Security Bulletin for April 2026. It includes important security fixes for the popular mobile system. The update has two parts—the 2026-04-01 and 2026-04-05 patch levels. Together, they fix many problems, from local Denial of Service (DoS) issues to serious flaws in special hardware.
The 2026-04-01 security update focuses on basic AOSP (Android Open Source Project) parts. The biggest problem found in this update is CVE-2026-0049, a serious weakness in the Framework part.
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
This flaw is particularly dangerous because it requires no special privileges and—most importantly—no action from the user to be exploited. As the bulletin warns, “The most severe of these issues is a critical security vulnerability in the Framework component that could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation”.
This “zero-interaction” DoS could let a harmful app or process “brick” a device’s software, making it unresponsive. This would need a hard reset or lead to ongoing problems in Android versions 14, 15, 16, and 16-qpr2.
The 2026-04-05 security patch updates the security system to cover special third-party parts and hardware security features. This part shows how Android security works together, with fixes from Google, NXP, STMicroelectronics, and Thales.
The main goal of this patch is CVE-2025-48651. This is a serious security issue that affects the StrongBox part. StrongBox is a special Hardware Security Module (HSM) found in modern Android devices. It stores sensitive keys and carries out secure tasks away from the main processor.
Google Components: Direct fixes for Google-specific integration and subcomponents.
Hardware Partners: Critical updates for NXP, STMicroelectronics, and Thales components to ensure the integrity of the StrongBox environment.
Android users should look at their Security patch level in System Settings. Users should also install system updates quickly when their device maker or carrier asks them to. This helps keep them safe from new threats.
