Google’s Android XR Security Bulletin for October 2026, published October 5, contains a ONE-line announcement: there are NO XR security patches this month. That is a QUIET result one month after the September bulletin, which carried a HIGH-severity privilege-escalation fix, CVE-2026-28659.
An empty XR bulletin does NOT mean headsets skip the October update. Google states that the FULL XR update comprises the security patch level from the main October 2026 Android Security Bulletin plus anything listed in the XR bulletin. With the XR list empty, Galaxy XR owners still depend on the base Android fixes arriving through Samsung’s firmware.
Two Patch Dates on One Page
The page is not fully CONSISTENT. Its introduction cites a security patch level of 2026-10-05 or higher, while the FAQ section tells manufacturers to set the patch string to 2026-10-01 and says levels of 2026-10-01 or later address all associated issues. The FAQ text appears to be shared boilerplate, but buyers checking a headset’s settings screen should treat 2026-10-05 as the safer TARGET, since that is the level the bulletin’s own intro names.
Google also repeats that device owners must contact their SUPPLIER for firmware images. For Galaxy XR that means Samsung, which recently said Android XR will get software updates and security patches for up to FIVE years counted from the headset’s October 2025 launch, alongside new Android Enterprise support (Samsung Newsroom; Android Authority).
Why It Matters
Android XR is moving from one headset toward a WIDER device family, with Samsung’s first camera-equipped Android XR glasses reportedly due in November (9to5Google). A monthly XR bulletin is the PUBLIC record of how that platform is patched. A zero-patch month is good news for current owners, but the five-year promise will be judged on how FAST fixes like September’s land on devices, not on how often the list is empty.
Sources: Android Open Source Project XR Security Bulletin (October 2026); Samsung Newsroom; Android Authority; 9to5Google.