InfoSecBulletin Cybersecurity for mankind
Google has shared its Android Security Bulletin for April 2026. It includes important security fixes for the popular mobile system. The update has two parts—the 2026-04-01 and 2026-04-05 patch levels. Together, they fix many problems, from local Denial of Service (DoS) issues to serious flaws in special hardware.
The 2026-04-01 security update focuses on basic AOSP (Android Open Source Project) parts. The biggest problem found in this update is CVE-2026-0049, a serious weakness in the Framework part.
Urgent patch! Cisco and IMB patch multiple flaws
OWASP Unveils GenAI LLM Top 10 2026 For Modern AI APPS
Greatness PhaaS Evades Email Security and MFA to Take Over Microsoft 365 Accounts
Pillar 4: Total 131 Indicators Set
How Bangladeshi’s Ogrs Be Evaluated By Newly Launched NRS & CIRS
Brazilian health surveillance platform breach exposes 100K+ sensitive documents
Thousands of data centers are at risk of compromise due to a 22-year-old flaw
Bangladesh Launches (CIRS) and National ICT & Cyber Security Rating System (NRS)
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
This flaw is particularly dangerous because it requires no special privileges and—most importantly—no action from the user to be exploited. As the bulletin warns, “The most severe of these issues is a critical security vulnerability in the Framework component that could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation”.
This “zero-interaction” DoS could let a harmful app or process “brick” a device’s software, making it unresponsive. This would need a hard reset or lead to ongoing problems in Android versions 14, 15, 16, and 16-qpr2.
The 2026-04-05 security patch updates the security system to cover special third-party parts and hardware security features. This part shows how Android security works together, with fixes from Google, NXP, STMicroelectronics, and Thales.
The main goal of this patch is CVE-2025-48651. This is a serious security issue that affects the StrongBox part. StrongBox is a special Hardware Security Module (HSM) found in modern Android devices. It stores sensitive keys and carries out secure tasks away from the main processor.
Google Components: Direct fixes for Google-specific integration and subcomponents.
Hardware Partners: Critical updates for NXP, STMicroelectronics, and Thales components to ensure the integrity of the StrongBox environment.
Android users should look at their Security patch level in System Settings. Users should also install system updates quickly when their device maker or carrier asks them to. This helps keep them safe from new threats.
