India's cybersecurity agency CERT-In has warned that “Multiple vulnerabilities have been reported in the Android operating system”. It has rated them “CRITICAL” in its latest vulnerability note, issued on November 4, 2026.

The flaws affect Android versions 14, 15, 16, 16-qpr2 and 17. The advisory is aimed at individuals and organisations that use these versions.

According to CERT-In, an attacker could exploit the flaws to gain elevated privileges, disclose sensitive information, execute arbitrary code or cause denial-of-service conditions on affected devices.

The agency says the weaknesses sit in Android components including Framework and System. They could lead to remote denial-of-service, local elevation of privilege and information disclosure.

CERT-In puts the risk of privilege escalation, information disclosure and denial-of-service as high, and warns that exploitation could also disrupt affected devices.

The advisory points to Google's Android Security Bulletin for October 2026, published on October 5 and updated on October 8. Google says the most severe issue is a critical flaw in the System component that could allow local escalation of privilege.

An attacker would need no additional execution privileges, and no user interaction is required. The most severe Framework flaw could cause remote denial of service under the same conditions.

Google adds that these ratings assume the platform and service protections are switched off for development purposes or have been bypassed. It says it notified its Android partners of all the issues at least a month before publishing the bulletin.

CERT-In's advice is to “Apply appropriate updates as mentioned by the vendor”.

Source link