Rita El Khoury / Android Authority

TL;DR

• Google has released the Android Security Bulletin for January 2026, addressing a critical Android vulnerability.
• The vulnerability can be used to trigger a zero-click attack on Android using an audio file.
• While the issue was fixed on Pixel devices last month, we’re still waiting for Google to fix other Pixel bugs, which should have been addressed in a separate Pixel Update for January.

Google has freshly released the Android Security Bulletin for January 2026, listing a critical vulnerability that will be addressed in security updates. The list isn’t quite as long as the December 2025 bulletin, and that is because Google recently moved to publicly disclose a large chunk of security issues in Android on a quarterly basis rather than every month. In fact, the only critical vulnerability listed in the bulletin relates to the Dolby Digital Plus Codec, which is used for playing audio files on Android.

As per Wiz, the vulnerability can allow hackers to manipulate the extra information, also known as evolution data, added to the audio file, which can force the player to crash on a broad range of devices. On Android specifically, it can be used to execute a zero-click attack when you open or receive the specific file via a messenger app.

While Google has patched the code in Android’s source code, manufacturers may take a while to implement it with separate security updates meant for their devices. Dolby acknowledged in October that “there is a possible increased risk of vulnerability if this bug is used alongside other known Pixel vulnerabilities.”

No Pixel Update though

While the exploit was listed in the Android Security Bulletin for January, Google had already patched it with the December security update for Pixel devices. Perhaps that is why a separate security update for Pixel devices hasn’t been released in January 2026.

Despite that, there are plenty more bugs affecting Pixel phones, including one that randomly makes the Pixel 10’s display unresponsive, and we hope Google fixed those with the January update. Google does not stick to a specific release schedule, and updates sometimes arrive later in the month — as it did on the 11th in November, so there’s still some hope it might roll out soon. But, to be honest, we can’t comment on the specific date.

That said, whether you’re using a Pixel or any other Android device, we recommend updating to the latest security update available.

Follow

Thank you for being part of our community. Read our Comment Policy before posting.