Google quietly maintains a separate security track for Android XR headsets. On SEPTEMBER 8, the company published the Android XR Bulletin — September 2026, pairing XR-specific PATCHES with the broader Android Security Bulletin that was later updated through SEPTEMBER 16.
For owners of Galaxy XR and other Android XR hardware, the full monthly update is not just the phone bulletin. Google says the complete XR package requires security patch level 2026-09-05 or later from the September Android bulletin, PLUS every issue listed in the XR bulletin itself.
The XR-Only Fix: CVE-2026-28659
The September XR bulletin is short. It lists a single System-component vulnerability:
- CVE-2026-28659 (Android bug A-470059188) — elevation of privilege (EoP), rated HIGH, affecting AOSP version 14.
Google’s severity language is the standard bulletin framing: the assessment assumes platform and service mitigations are off for development, or successfully bypassed. The bulletin’s lead copy is incomplete in places (“a unknown security vulnerability… that could”), but the table is clear — one HIGH PRIVILEGE-ESCALATION fix keyed to the 2026-09-01 XR patch level.
How the Two Bulletins Stack
Android XR Security Bulletins supplement the main Android Security Bulletins. They do not replace them. Device makers that ship Android XR must roll BOTH:
- All issues tied to Android patch level 2026-09-05 (or later) from the September phone/tablet bulletin.
- The XR-specific CVE above, which lets a device declare XR patch string
2026-09-01.
Google tells OEMs to set ro.build.version.security_patch to 2026-09-01 when the XR fixes are present, and notes that Android XR devices typically start receiving OTA UPDATES the same month the bulletin drops. Firmware images still come from each device supplier — Samsung for Galaxy XR, and whoever else is shipping Android XR SKUs.
Why It Matters for Spatial Gear
A headset is a camera-rich, always-listening computer on your face. ELEVATION-OF-PRIVILEGE bugs in the System component are exactly the class of issue that can turn a local foothold into broader control. Google does not publish exploit STATUS or in-the-wild reports for CVE-2026-28659 in this bulletin — only the classification, severity, and AOSP version scope.
The practical check for owners is simple: open the headset’s software UPDATE screen and confirm the security patch date is at least SEPTEMBER 2026 (2026-09-05 for the base Android issues, with the XR package applied). If the device still reports June or July 2026, the September XR bulletin has not landed yet — contact the OEM for the firmware image.
Sources: Android XR Bulletin — September 2026; Android Security Bulletin — September 2026 (updated Sep 16); Android XR Security Bulletin index.