Google's May 2026 Android security bulletin includes a critical vulnerability in the System component that could allow remote code execution in certain conditions. Exploitation needs no user interaction. If you have been putting off your latest Android update, this is the month to stop.
What the bulletin fixes
Google's official bulletin, published on May 4, 2026, tracks the most serious issue as CVE-2026-0073. Google rates it critical and says it affects the System component. That component sits deep in Android, so the flaw is not confined to one app.
Google also notes that devices on Android 10 and later may get protection through both standard security updates and Google Play system updates, depending on the device and vendor rollout.
| Detail | What Google says |
|---|---|
| Bulletin name | Android Security Bulletin, May 2026 |
| Published date | May 4, 2026 |
| Most serious issue | CVE-2026-0073 |
| Severity | Critical |
| Risk type | Remote code execution |
| User interaction required | No |
| Patch level to look for | 2026-05-01 or later |
If your phone shows a security patch level of 2026-05-01 or later, Google says it includes the fixes tied to that level.
How serious it is
The critical rating is in the bulletin itself. Google flags it explicitly rather than burying it in the list.
No user interaction means this is not a "don't click suspicious links" problem. That doesn't make every Android phone instantly exposed in the same way, but flaws in this category don't give you a second chance to notice a bad link.
The bulletin references updated AOSP versions including 14, 15, 16 and 16-qpr2, so the fix covers a wide slice of the ecosystem.
Who should update first
Nearly everyone with a supported phone. The people with the most reason to hurry:
- Pixel owners, who normally get monthly updates first
- Samsung, Xiaomi, OnePlus, Motorola and other users waiting on a vendor patch
- Anyone who sideloads apps outside Google Play more often than average
- Owners of older phones that still get security patches but lag behind flagships
- Anyone who uses their phone for banking, work accounts, 2FA codes or a password manager
If your phone is still supported, install the update as soon as it appears.
Check whether your phone has the fix
On most Android phones:
- Open Settings.
- Go to Security & privacy or About phone.
- Look for Android security update or Security patch level.
- Check whether the date is 2026-05-01 or newer.
Then check for a Google Play system update, since some devices on Android 10 and later are covered that way:
- Open Settings.
- Tap Security & privacy.
- Open System & updates or Google Play system update.
- Install any pending update.
- Restart the phone if prompted.
An older date doesn't mean your phone is unsafe forever. Often your brand just hasn't pushed the patch to your region yet. Keep checking instead of assuming you're covered.
Pixel rollout
Google's Pixel Update Bulletins page says Pixel OTA updates start the same day the monthly bulletin is released. Rollout to every eligible Google device can take about one and a half calendar weeks, so your phone may not have it yet. If you own a Pixel and haven't seen it, check for updates manually.
Samsung, Xiaomi and other brands
Other brands need more time because each company packages, tests and releases updates for its own devices and regions. In practice:
- Current flagships often get the patch quickly.
- Mid-range phones get it later in the month.
- Some older supported devices get it through a slower regional rollout.
If you use a Galaxy, Xiaomi, Redmi, POCO, OnePlus, Nothing or Motorola phone, expect to wait. Keep checking both the full system update and the Google Play system update.
While you wait
None of this replaces the patch, but it lowers the risk in the meantime:
- Keep Google Play Protect enabled.
- Avoid installing APKs from untrusted sources.
- Update your core apps from the Play Store.
- Restart your phone after installing any security-related update.
- Use the latest browser and messaging app versions.
FAQ
What patch level should I look for?
2026-05-01 or later.
What is CVE-2026-0073?
The critical vulnerability in Google's May 2026 bulletin. Google classifies it as a remote code execution issue in the System component.
Do I need a full phone update or just a Google Play system update?
It depends on the device. Google says some devices on Android 10 and later may get protection through Google Play system updates as well as standard security updates.
Are Pixel phones already getting the update?
Yes. Pixel rollout typically starts the same day the monthly Pixel bulletin is released, though full rollout can take around a week and a half.
