Bottom line: Google patches 18 critical vulnerabilities in current Android versions that enable local code execution with system privileges.
Google has closed 18 critical security vulnerabilities in Android 14, 15, and 16 on its patch day, through which attackers can locally execute malicious code with system privileges.
Google released updates for multiple critical vulnerabilities in the current Android versions. The vulnerabilities allow attackers to execute malicious code with the privileges of the affected system following successful exploitation.
For CISOs, this represents increased exposure in mobile security within the organization. If employees use Android devices for business purposes — such as email, VPN, or cloud authentication — compromised devices can serve as an entry point for network access. Since the vulnerabilities are classified as critical, there is a high probability of rapid exploit availability and targeting.
Quick inventory of all Android devices in the infrastructure and prioritized security update rollout planning are essential. Special attention should be paid to endpoints that access NIS2-relevant systems or process sensitive data. Timely updates significantly reduce the exploitation window.
Source: www.heise.de · Published June 2, 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.2.9.