New Delhi: The Indian Computer Emergency Response Team (CERT-In) has issued a high-risk security alert for Android users, warning that multiple vulnerabilities across different versions of the operating system could expose smartphones and sensitive personal information to cyberattacks.

The government cybersecurity agency has advised users to install the latest available security updates as soon as possible. The warning covers Android 14, Android 15, Android 16, Android 16 QPR2 and Android 17, with vulnerabilities identified across several core components of the operating system.

Google’s September 2026 Android Security Bulletin also confirms multiple critical vulnerabilities affecting supported Android versions. The bulletin says security patch levels dated September 1, 2026, or later address the issues covered by the September security release.

CERT-In flags multiple Android vulnerabilities

According to the government alert, the vulnerabilities affect several parts of the Android operating system, including Android Runtime, DocumentsUI, MediaTek Framework, Media Codecs, MediaProvider, Telephony, Ultra-Wideband (UWB) and Wi-Fi.

The flaws have been classified as high severity, with some capable of allowing attackers to execute arbitrary code, gain elevated system privileges, access sensitive information or cause denial-of-service conditions.

Google’s official security bulletin provides further details on the severity of the vulnerabilities. It identifies several critical remote-code-execution (RCE) and elevation-of-privilege flaws in the Android System and Framework components.

One of the critical System vulnerabilities could allow remote code execution without requiring additional execution privileges or user interaction, according to Google.

Android 14 to Android 17 users affected

The CERT-In warning covers a wide range of relatively recent Android versions.

Users running:

  • Android 14
  • Android 15
  • Android 16
  • Android 16 QPR2
  • Android 17

are advised to check whether the latest security update is available for their devices.

However, the availability and timing of an update can vary between smartphone manufacturers and individual models. Google notes that device manufacturers incorporate Android security fixes into their own software updates.

This means users should not assume that simply having a newer Android version automatically means their phone is protected. The security patch level installed on the device is also important.

Why the warning matters

Modern smartphones contain a large amount of personal and financial information.

Photos, messages, contacts, documents, passwords, banking information and account credentials are routinely stored or accessed through smartphones. A serious operating system vulnerability can therefore have consequences beyond the phone itself.

If attackers successfully exploit an unpatched flaw, they could potentially gain access to protected parts of the device, elevate their privileges or execute malicious code, depending on the vulnerability involved.

CERT-In has therefore advised users not to delay installing available security updates.

The risk is particularly important for people who use their smartphones for banking, digital payments, work-related accounts and other sensitive activities.

Google has already released security fixes

The good news for Android users is that patches for the vulnerabilities have already been released through Google’s Android security update programme.

Google’s September 2026 Android Security Bulletin states that security patch levels of 2026-09-01 or later address all issues associated with that month’s security patch level. Devices receiving the later 2026-09-05 patch level include the applicable fixes from the September bulletin.

Google published the September bulletin on September 8 and updated it on September 15 with additional issue details and AOSP links.

Users should therefore check their device’s security patch date and install any pending update provided by their manufacturer.

How to update an Android phone

The exact process varies depending on the smartphone brand, but Android users can generally check for updates through the Settings menu.

On many devices, users can go to:

Settings → System → Software update

On some phones, the option may instead appear under:

Settings → Security & privacy → System updates

The menu names can differ across Samsung, Google Pixel, Motorola, Xiaomi, OnePlus, Oppo, Vivo and other Android devices.

Users should install the latest available operating system and security update offered specifically for their model.

Google recommends that devices use the latest applicable security patch level.

Security updates are different from Android version upgrades

One important point for users is that a security update does not necessarily mean upgrading to an entirely new Android version.

A smartphone running Android 14, for example, may receive a security patch without being upgraded to Android 15 or Android 16.

The security patch level indicates whether known vulnerabilities have been addressed. Google says manufacturers should use patch strings such as 2026-09-01 or 2026-09-05 for devices incorporating the corresponding fixes.

Users should therefore check both their Android version and security patch date rather than relying only on the version number.

Avoid unknown apps and suspicious links

Installing the latest security update is only one part of smartphone security.

CERT-In also recommends avoiding applications from unknown sources and exercising caution when opening suspicious links or files received through messages, emails or social media.

Users should download applications through trusted sources and be particularly careful with links asking for passwords, banking information, OTPs or other sensitive details.

Even when a phone has received the latest security patch, phishing attacks and malicious applications can still pose risks.

What Android users should do now

Android users should first check the security update section on their phones and install any pending update from the manufacturer.

If an update is available, it is advisable to install it promptly rather than postponing it. Users should also restart the phone if required and check the security patch date after installation.

For people whose phones no longer receive security updates, the CERT-In warning is also a reminder of the importance of using devices that continue to receive security support.

The September Android security bulletin shows why timely updates matter. Several vulnerabilities have been rated critical, including flaws that could potentially enable remote code execution without user interaction.

With smartphones increasingly being used for banking, payments, communication and storing personal information, keeping the operating system updated remains one of the simplest ways for users to reduce exposure to known security threats.