InfoSecBulletin Cybersecurity for mankind
Google has shared its Android Security Bulletin for April 2026. It includes important security fixes for the popular mobile system. The update has two parts—the 2026-04-01 and 2026-04-05 patch levels. Together, they fix many problems, from local Denial of Service (DoS) issues to serious flaws in special hardware.
The 2026-04-01 security update focuses on basic AOSP (Android Open Source Project) parts. The biggest problem found in this update is CVE-2026-0049, a serious weakness in the Framework part.
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Hackers Exploiting MikroTik RouterOS Flaw Gaining Network Access
CrowdStrike launches SafeMind, the first agentic cybersecurity solution for defenders
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
Microsoft Reveals Project Zenith Windows PCs Able to Run 30B+ AI Models Locally
Google issues warning of new Chrome zero-day flaw exploited
This flaw is particularly dangerous because it requires no special privileges and—most importantly—no action from the user to be exploited. As the bulletin warns, “The most severe of these issues is a critical security vulnerability in the Framework component that could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation”.
This “zero-interaction” DoS could let a harmful app or process “brick” a device’s software, making it unresponsive. This would need a hard reset or lead to ongoing problems in Android versions 14, 15, 16, and 16-qpr2.
The 2026-04-05 security patch updates the security system to cover special third-party parts and hardware security features. This part shows how Android security works together, with fixes from Google, NXP, STMicroelectronics, and Thales.
The main goal of this patch is CVE-2025-48651. This is a serious security issue that affects the StrongBox part. StrongBox is a special Hardware Security Module (HSM) found in modern Android devices. It stores sensitive keys and carries out secure tasks away from the main processor.
Google Components: Direct fixes for Google-specific integration and subcomponents.
Hardware Partners: Critical updates for NXP, STMicroelectronics, and Thales components to ensure the integrity of the StrongBox environment.
Android users should look at their Security patch level in System Settings. Users should also install system updates quickly when their device maker or carrier asks them to. This helps keep them safe from new threats.
