June 2026: Security Update
The most important Android story of the week is not a flashy new feature — it is a patch most people have not installed yet. Google’s June 2026 security update closes 124 vulnerabilities, including a Framework flaw that attackers are already exploiting in the wild. Layered on top of that are a consumer Feature Drop, a fourth Android 17 QPR1 beta for Pixel, an expanding One UI 9 beta from Samsung, and a steady drip of Pixel 11 silicon leaks. Here is where the ecosystem stands as the week closes on June 14, 2026.
1. The June security update fixes an actively exploited zero-day
The June 2026 Android security bulletin patches 124 vulnerabilities, and one of them matters more than the rest. Tracked as CVE-2025-48595 with a CVSS score of 8.4, it is a privilege escalation flaw in the Framework component, and Google has confirmed it is under active exploitation. The bug affects devices running Android 14, Android 15, Android 16, and Android 16 QPR2, which covers the overwhelming majority of phones in active use today.
Privilege escalation flaws are dangerous because they let an attacker who already has a foothold — often through a malicious app — climb to permissions they were never granted. That can mean access to data from other apps, system settings, or components that should be sealed off. The fact that this one is being exploited rather than merely theorized is what pushes it to the top of the priority list.
Why the patch gap is the real story
The uncomfortable part is adoption. This is one of the largest Android security updates of the year, and the bulk of users have not yet applied it. Security patches only protect devices that actually install them, and the lag between release and installation is exactly the window attackers count on.
Check your device now. Open Settings → Security & privacy → System & updates and confirm your security patch level reads either June 1, 2026 or June 5, 2026. If it does not, install the update before doing anything else this week.
2. The June Feature Drop adds scam defenses and smarter search
Alongside the security work, Google shipped its June 2026 Feature Drop, and the headline addition is a security tool that unmasks contact-spoofing scammers — the callers who fake a trusted name or number to slip past your guard. It is a meaningful move at a moment when voice and message fraud keep climbing.
The drop also expands Circle to Search, whose multi-object identification now reaches every device on Android 14 and above rather than a narrow flagship slice. That widens one of the most genuinely useful AI features on the platform to hundreds of millions of additional phones.
Digital Wardrobe and Gboard get the fun additions
Google Photos begins rolling out its Digital Wardrobe feature to eligible users in the United States, India, and Brazil on devices running Android 10 or later, giving the update unusually broad reach for a Photos addition. On the lighter side, Gboard’s Emoji Kitchen gains a batch of new combinations themed around bugs and small animals, including “cute critters” and “blingy bees.” Our full June 2026 Feature Drop walkthrough covers every change and which devices qualify.
3. Android 17 QPR1 Beta 4 lands for Pixel
Google released Android 17 QPR1 Beta 4 to compatible Pixel devices on June 10, 2026, the fourth beta on the road to a stable quarterly release expected in September. The build carries seven bug fixes targeting issues that beta testers have been living with.
Those fixes include an invisible mouse pointer on external displays when Work profile or FLAG_SECURE apps are active, a Settings crash when opening credential provider settings from a Private Space, screenshot sounds incorrectly tied to ringer volume, video recording frame jumps at 5x zoom, and Back Tap gestures failing on the interactive lock screen.
Screen Reactions arrives, Pixel 6 sits this one out
The standout new feature is Screen Reactions for Android’s built-in screen recorder, first previewed at Google I/O 2026. It overlays your front-facing camera in a floating window while you record the screen — useful for tutorials, reactions, and walkthroughs without third-party tools.
There is one notable absence. Google pulled the Pixel 6 and Pixel 6 Pro from Beta 4, though it says both will return in the next beta. The build is available for the Pixel 6a and newer. Pixel beta testers can grab it through Settings → System → System update after enrolling. For the broader feature picture.
4. Samsung widens the One UI 9 beta program
Samsung’s Android 17-based One UI 9 beta is no longer a flagship-only affair. After launching the program on the Galaxy S26 series, Samsung has begun testing One UI 9 on three more devices — the Galaxy A17 5G, the Galaxy A34, and the Galaxy A57 — a sign the company is validating the release across its mid-range lineup earlier than usual.
The stable One UI 9 is still expected to debut alongside the new foldables in July 2026, with the Galaxy S25 and S24 series following in August and September, and the Galaxy S23 series, A-series, and tablets arriving toward the end of the year. Readers tracking eligibility can consult our running Android 17 device rollout guide.
5. Pixel 11 and Tensor G6 leaks sharpen the August picture
The Pixel 11 rumor mill keeps turning. The latest leaks describe a Tensor G6 built on TSMC’s 2nm process, paired with a PowerVR C-Series GPU, a MediaTek M90 modem, Google’s Titan M3 security chip, and a dedicated Tensor Processing Unit. The CPU moves to a seven-core layout led by a single ARM C1-Ultra core clocked at 4.11 GHz.
The catch is the GPU. The leaked PowerVR part appears to derive from older architecture, raising the possibility of a faster CPU paired with flat or even weaker graphics performance — a familiar Tensor trade-off. Other leaks point to new Pro-tier OLED panels, smaller batteries across the lineup, fresh camera sensors on the Pro models, and an ambient lighting feature called Pixel Glow. A formal announcement is expected in August 2026. Our Pixel 11 leak roundup tracks every confirmed and rumored spec.
Developer impact
Two items demand developer attention this week. First, CVE-2025-48595 is a Framework-level privilege escalation under active exploitation — if your app handles sensitive data or relies on permission boundaries, confirm your test devices are on the June patch and review any assumptions about inter-app isolation. Second, the Circle to Search multi-object expansion to Android 14 and above means visual-search entry points now reach a far wider install base, so apps surfacing images or product content should make sure their content is structured to benefit from on-screen recognition.
QPR1 Beta 4 is also worth flashing to a secondary Pixel before the stable September release. Test external-display behavior, Private Space credential flows, and screen-recording integrations now, while there is still time to file feedback that lands in the stable build.
What to watch next
The calendar tightens from here. Samsung Unpacked in London on July 22, 2026 should bring the Galaxy Z Fold 8 and Z Flip 8 with stable One UI 9, and the Pixel 11 announcement is expected in the second half of August. Between now and then, the single most valuable thing you can do is the least glamorous: open Settings → Security & privacy → System & updates and install the June patch if you have not already.