Following March’s heavy list of updates, patching a new record of 129 vulnerabilities, it doesn’t come as a surprise that April’s security bulletin is lighter.

While April’s bulletin is lighter in volume, the severity of these patches are still high. Most critical is CVE-2026-0049, which is connected to the device framework. The Android framework is foundation for building Android applications and includes a set of APIs and services. The security flaw can be exploited without any user interaction or without additional execution privileges needed, resulting in denial of service and persistent system instability.

The response is simple; organisations need to ensure they’re updating the entirety of their devices in line with the issuing of these updates. Any delays give threat actors extra time to exploit these vulnerabilities and the potential to gain access to the corporate network.