Indian cyber watchdog warns Android 14 to 17 users: Your phone data could be at risk

Malicious actors could exploit systemic OS weaknesses to harvest sensitive data or remotely disrupt vulnerable devices, prompting urgent calls for immediate software patches. Check how upcoming security update protocols plan to block these exploits.

India's cybersecurity agency CERT-In has warned that "Multiple vulnerabilities have been reported in the Android operating system". It has rated them "CRITICAL" in its latest vulnerability note, issued on November 4, 2026.

The flaws affect Android versions 14, 15, 16, 16-qpr2 and 17. The advisory is aimed at individuals and organisations that use these versions.

According to CERT-In, an attacker could exploit the flaws to gain elevated privileges, disclose sensitive information, execute arbitrary code or cause denial-of-service conditions on affected devices.

The agency says the weaknesses sit in Android components including Framework and System. They could lead to remote denial-of-service, local elevation of privilege and information disclosure.

CERT-In puts the risk of privilege escalation, information disclosure and denial-of-service as high, and warns that exploitation could also disrupt affected devices.

Google's Own Findings

The advisory points to Google's Android Security Bulletin for October 2026, published on October 5 and updated on October 8. Google says the most severe issue is a critical flaw in the System component that could allow local escalation of privilege.

An attacker would need no additional execution privileges, and no user interaction is required. The most severe Framework flaw could cause remote denial of service under the same conditions.

Google adds that these ratings assume the platform and service protections are switched off for development purposes or have been bypassed. It says it notified its Android partners of all the issues at least a month before publishing the bulletin.

Update Now

CERT-In's advice is to "Apply appropriate updates as mentioned by the vendor". Devices with a security patch level of 2026-10-01 or higher are protected against all the issues listed in Google's bulletin.

Source code patches have been released to the Android Open Source Project, and the bulletin also links to patches outside it. Devices running Android 10 and later may receive security updates as well as Google Play system updates.

Google says newer Android versions make many of these flaws harder to exploit. "We encourage all users to update to the latest version of Android where possible."

Its Google Play Protect service warns users about potentially harmful apps. It is switched on by default on devices with Google Mobile Services, and matters most for people who install apps from outside Google Play.