October Android bulletin flags patch-level work for degoogled ROMs

What changed

Google’s October Android Security Bulletin was published on October 5 and updated on October 8 with AOSP links. It says Android security patch levels of 2026-10-01 or higher address the listed issues, and its version table says the October 8 update added AOSP links.

The bulletin’s summary flags the most severe problem as a critical vulnerability in the System component that could lead to local escalation of privilege, with no additional execution privileges and no user interaction needed. The rest of the list covers the Framework and System components, including Bluetooth, NFC, Wi-Fi and telephony code. The bulletin does not say that any of the issues are being exploited.

HKCERT’s advisory on the October fixes, released October 7, says Android devices with a security patch level prior to 2026-10-01 are affected. It counts 25 CVEs, rates the overall risk as medium, and lists possible impacts as denial of service, elevation of privilege, remote code execution, and information disclosure.

GrapheneOS users have a more specific data point: the project’s October release notes for build 2026100600 list a full 2026-10-05 security patch level, October 2026 Pixel firmware and HALs, a fix for an upstream ZipFileRO.cpp integer-overflow bug, and Seedvault changes.

Why patch-level work matters for degoogled ROMs

The security patch level is the date string in your settings that tells you which bulletin your phone claims to include. For Google’s own Pixel software it moves on the day the update lands. For a degoogled ROM, someone has to take the AOSP patches, merge them into the project’s code, build for each device and ship the result. GrapheneOS does that quickly for Pixels; community ROMs depend on the project and, often, on a volunteer maintainer for each phone.

A few bulletin items also travel by a separate route. Fixes in Project Mainline components (this month that includes telephony and Wi-Fi modules) can reach some Android 10+ devices through Google Play system updates. Degoogled systems without Google Play don’t receive those, so for them the full ROM update is the only path, which is why it pays to watch your updater rather than assume.

If you want a single rule: on a degoogled phone, the patch level in Settings is the source of truth, not the date of the last download.

Which phones this touches

HKCERT’s scope is simple: every Android phone below the 2026-10-01 patch level. In practice, for the systems we cover:

• GrapheneOS on Pixel 6 through Pixel 10a, Pixel Tablet and Pixel Fold: covered by 2026100600 or newer.
• CalyxOS, LineageOS, /e/OS and iodéOS: covered once your updater shows an October 2026 patch level. Check, don’t assume.
• Phones whose ROM or manufacturer has stopped shipping updates: not covered, and they won’t be.

What to do

1. Open Settings → About phone (or Security) and read the “Android security update” or “security patch level” date.
2. If you run GrapheneOS, check Settings for the 2026100600 build or newer. The release notes say it applies to supported Pixels from Pixel 6 through Pixel 10a, plus Pixel Tablet and Pixel Fold.
3. If you run another degoogled OS, do not assume the October patches are present until your updater shows an October 2026 security patch level. The AOSP bulletin is the baseline; projects still need to integrate, test, and ship it for their device trees.
4. For phones that are no longer receiving ROM updates, this is the kind of bulletin that should push you toward replacing the device or moving to a maintained build — see which systems still cover your model in our OS-by-device list, or browse phones with long update support.
5. For app-only degoogling on stock Android, install the vendor update when it appears. Google Play system updates can cover some Mainline components, but the bulletin still tells device manufacturers to include the full patch set for the security patch level they claim.

None of this calls for panic. It is the normal monthly rhythm, and the habit that protects you is simple: know your patch level, and replace a phone once it stops moving.