Google has published its October 2026 Pixel Update Bulletin, moving all supported Pixel devices to the 2026-10-05 security patch level and addressing several serious Pixel-specific vulnerabilities.

The bulletin was published on October 6, one day after Google's broader October Android Security Bulletin. Google says all supported Pixel devices will receive the October 5 patch and encourages customers to install the update.

The update is documented in Google's official Pixel Update Bulletin and complements the vulnerabilities addressed in the October 2026 Android Security Bulletin.

Three Pixel-specific vulnerabilities are rated critical

Google's Pixel bulletin identifies three Pixel-specific issues with a Critical severity rating.

CVE-2026-55330 affects Bluetooth and is classified as an elevation-of-privilege vulnerability.

CVE-2026-56952 affects GDMC and is also classified as elevation of privilege.

CVE-2026-55307 affects GSA and is classified as an information-disclosure vulnerability.

The bulletin also lists CVE-2026-0198, a high-severity GDMC information-disclosure issue.

Kernel components receive additional fixes

The Pixel-specific release also addresses two high-severity kernel-component vulnerabilities.

CVE-2026-56906 affects the filesystem subsystem, while CVE-2026-56936 affects Wacom HID. Google classifies both as elevation-of-privilege vulnerabilities.

The October 5 patch incorporates the broader Android fixes

The Pixel bulletin is only one part of the security picture.

Google's October Android Security Bulletin, published October 5, documents vulnerabilities affecting the wider Android platform. Google states that the most severe issue in that bulletin is a critical System-component vulnerability capable of causing local elevation of privilege without requiring additional execution privileges or user interaction.

For Pixel devices, installing a security patch level of 2026-10-05 or later addresses the issues associated with the Pixel bulletin as well as the vulnerabilities covered by the October Android Security Bulletin.

Why Pixel has a separate bulletin

Google separates vulnerabilities that apply specifically to its devices from vulnerabilities documented in the general Android bulletin.

The Android Security Bulletin contains issues needed to declare Android security patch levels. The Pixel bulletin can contain additional vulnerabilities affecting Google hardware and software components that are not required for declaring the general Android patch level.

This separation matters when evaluating device exposure: the Android patch date alone does not describe every vendor-specific vulnerability fixed on a particular device.

Public technical details remain limited for several issues

The Pixel bulletin marks several Android bug references with an asterisk, indicating that those issues are not publicly available.

Google notes that fixes for such vulnerabilities are generally included in the latest binary drivers available through its developer resources.

This is standard practice for security updates where disclosing full implementation details before devices are patched could increase exploitation risk.

Supported Pixel devices move to October 5

Google's guidance is straightforward: every currently supported Google device will receive an update to the October 5 security patch level.

Users can verify their installed security patch from Android's system settings. A patch level of 2026-10-05 or later indicates that the October Pixel security issues have been addressed.

The LMBDA takeaway

The October release illustrates why mobile security should be evaluated as a layered update system rather than by looking at a single CVE or bulletin.

A Pixel device receives fixes from the general Android security process and an additional Google-device-specific layer. The October 2026 release includes multiple critical Pixel vulnerabilities across Bluetooth, GDMC and GSA, making the update materially important for supported devices.

For researchers and automated security-monitoring systems, the useful signal is therefore not merely that an “October update” exists. The relevant state is whether a device has actually reached the 2026-10-05 patch level that incorporates both Android and Pixel-specific fixes.