CVE-2026-0049: Google Confirms Zero-Interaction Android Vulnerability

It has been a relatively busy start to the month for Google users, at least as far as security issues are concerned. There was the zero-day attack alert for Chrome users, which is as serious as things come, but otherwise, followed by a password-stealer warning aimed at the same folks. Android users, meanwhile, have been breathing a sigh of relief. But that has all changed as Google rolls out the latest Android Security Bulletin, which contains confirmation of CVE-2026-0049, a critical vulnerability impacting billions of users.

OK, so a denial-of-service attack might not strike you as the most terrible thing that can happen, but it should. A successful exploit of CVE-2026-0049 could temporarily brick your smartphone. Hard resets are no fun when you have to apply them over and over again, and this vulnerability could cause such persistent instability. Who is affected? Google said it affects users of Android versions 14, 15, 16 and 16-qpr2. Or, if you prefer, billions of people, as these are the most popular of operating system versions.

“Following March’s heavy list of updates, patching a new record of 129 vulnerabilities, it doesn’t come as a surprise that April’s security bulletin is lighter,” Adam Boynton, a senior enterprise strategy manager with Jamf, told me. However, Boynton warned that the severity of the vulnerabilities was high, and none more critical than CVE-2026-0049 itself. “The Android framework is the foundation for building Android applications and includes a set of Application Programming Interfaces and services,” Boynton explained.

The good news is that, this being part of the Google Android Security Bulletin, the vulnerability has a fix. And that fix is to apply the latest security updates to your Android device. As such, I would recommend that you check your Security patch status as soon as possible. You can find this in the settings app by following the about device option and then choosing either Android or security version. To update to the latest available patch, head for Settings|System|System Update. Meanwhile, for the non-consumer readership, Boynton advised that “organizations need to ensure they’re updating the entirety of their devices in line with the issuing of these updates,” adding that “any delays give threat actors extra time to exploit these vulnerabilities and the potential to gain access to the corporate network.”