Releasebot
Docs Latest Create account

Desktop and Mobile Operating Systems Release Notes

Updates for desktop and mobile operating systems and Linux distributions.

Get this feed:

Products (7)

Latest Desktop and Mobile Operating Systems Updates

  • Nov 10, 2026
    • Date parsed from source:
      Nov 10, 2026
    • First seen by Releasebot:
      Nov 11, 2026
    Google logo

    Android by Google

    Gemini Intelligence: New features, on more devices

    Android expands Gemini Intelligence to more devices, bringing its capabilities to a broader range of users.

    Gemini Intelligence is rolling out to more devices. See how expanded capabilities across these devices help you do more.

    Original source
  • Nov 10, 2026
    • Date parsed from source:
      Nov 10, 2026
    • First seen by Releasebot:
      Nov 11, 2026
    Microsoft logo

    Windows by Microsoft

    November 10, 2026—KB5132061 (OS Builds 26300.9974, 26200.9974 and 26100.9974)

    Windows releases a security and quality update for Windows 11 that expands automatic Secure Boot certificate coverage, strengthens NTLM and PowerShell security, and fixes USB audio, printer setup, and Remote Desktop issues. It also updates Cuba’s daylight saving time rules.

    Announcements and messages

    This section provides key notifications related to this release, including announcements, change logs, and end-of-support notices.

    Important

    Because of minimal operations during the Western holidays and the upcoming new year, there will be no December 2026 non-security preview update in the second part of the month. Normal monthly servicing for both security and non-security preview updates will resume in January 2027.

    Improvements

    This update includes improvements from the following previously released updates:

    • October 13, 2026—KB5127648 (OS Builds 26300.9711, 26200.9711 and 26100.9711)
    • October 26, 2026—KB5134133 (OS Builds 26300.9725, 26200.9725 and 26100.9725) Out-of-band
    • October 28, 2026 — KB5127936 (OS Builds 26300.9818 and 26200.9818) Preview

    Applies to: Windows 11, versions 26H2 and 25H2, all editions

    This security update includes quality improvements. Key changes include:

    • [Security updates] This update provides security improvements. For more information about the security vulnerabilities resolved by this update, see the Security Update Guide.
    • [Secure Boot] This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. Certificate deployment via Windows updates continues across supported PCs and non-managed business devices in the coming months.
    • [Audio (known issue)] - Fixed: USB Audio 1.0 devices might fail to start and display error code 10 in Device Manager after installing a recent security update.
    • [Printing] Fixed: Adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device might fail with error 87, “The parameter is incorrect.” This issue was introduced by the October 2026 update and does not generally affect existing printers or printing.
    • [Security] This update improves NTLM security by enabling clients to offer NTLM message signing by default for non-anonymous connections. This change helps reduce exposure to NTLM relay attacks and provides auditing to identify connections that are not using signing. To learn more, see NTLM signing security improvements in Windows.
    • [Date and Time] This update adjusts daylight saving time (DST) rules for Cuba for the extended 2026-2027 DST period. Cuba remains on UTC-04:00 and doesn't observe the November 2026 and March 2027 transitions. It returns to UTC-05:00 in November 2027 and resumes its regular seasonal schedule in 2028.
      • For the latest DST and time zone guidance, see the Daylight Saving Time & Time Zone Blog.
    • [Remote Desktop] This update addresses an issue where Remote Desktop Protocol (RDP) connections might fail on the client due to a certificate mismatch after the October 2026 non-security preview update.
    • [Windows PowerShell] This update strengthens security for PowerShell script signing and signature verification by introducing stricter encoding validation. As a result, scripts containing invalid UTF-8 encoding might fail signature validation, even if they were previously accepted. To resolve this issue, review the affected scripts, save them using valid UTF-8 encoding with a byte order mark (BOM), and sign them again. For further guidance, see Encoding Guidance for Signed PowerShell Scripts.

    Known issues in this update

    Microsoft is not currently aware of any issues with this update.

    File information

    A list of the files that are included in this update are provided in a CSV (Comma delimited) (*.csv) file. The file can be opened in a text editor such as Notepad or in Microsoft Excel.

    Note: The English (United States) version of this software update might contain files for additional languages.

    Download the file information for cumulative update KB5132061.

    Download the file information for SSU (KB5132688 - version 26100.9971.

    Original source

  • All of your release notes in one feed

    Join Releasebot and get updates from Google and hundreds of other software products.

    Create account
  • Nov 8, 2026
    • Date parsed from source:
      Nov 8, 2026
    • First seen by Releasebot:
      Nov 9, 2026
    GrapheneOS logo

    GrapheneOS

    2026110800

    GrapheneOS ships a security preview with Android 17 patches from six security bulletins and a Pixel 10 kernel fix for a suspend accounting bug, strengthening security and improving device behavior.

    Tags:

    Changes since the 2026110700 release:

    All of the Android 17 security patches from the current December 2026, January 2027, February 2027, March 2027, April 2027 and May 2027 Android Security Bulletins are included in the 2026110801 security preview release. List of additional fixed CVEs:

    For detailed information on security preview releases, see our .post about it

    (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold)2026110800

    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): backport fix from Android 17 QPR2 Beta for upstream Pixel suspend accounting bug also impacting the stock OS (this became much more frequent with the GKI update included in the previous release)2026110700
    • Critical: CVE-2026-28666, CVE-2026-49921, CVE-2026-58820, CVE-2026-59062, CVE-2026-59069, CVE-2026-104172, CVE-2027-0001, CVE-2027-0160, CVE-2027-0165, CVE-2027-0212, CVE-2027-0255, CVE-2027-0279
    • High: CVE-2025-48654, CVE-2026-28611, CVE-2026-28619, CVE-2026-28635, CVE-2026-45523, CVE-2026-47964, CVE-2026-49914, CVE-2026-55260, CVE-2026-55274, CVE-2026-55281, CVE-2026-55284, CVE-2026-58860, CVE-2026-58869, CVE-2026-58872, CVE-2026-58935, CVE-2026-58954, CVE-2026-58958, CVE-2026-58960, CVE-2026-58972, CVE-2026-58973, CVE-2026-58993, CVE-2026-58998, CVE-2026-59013, CVE-2026-59017, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59052, CVE-2026-59053, CVE-2026-59054, CVE-2026-59055, CVE-2026-59056, CVE-2026-59057, CVE-2026-59058, CVE-2026-59059, CVE-2026-59061, CVE-2026-59063, CVE-2026-59064, CVE-2026-59065, CVE-2026-59067, CVE-2026-59068, CVE-2026-59070, CVE-2026-59071, CVE-2026-104154, CVE-2026-104155, CVE-2026-104156, CVE-2026-104157, CVE-2026-104158, CVE-2026-104159, CVE-2026-104160, CVE-2026-104161, CVE-2026-104162, CVE-2026-104163, CVE-2026-104164, CVE-2026-104166, CVE-2026-104167, CVE-2026-104170, CVE-2026-104171, CVE-2027-0002, CVE-2027-0010, CVE-2027-0011, CVE-2027-0012, CVE-2027-0065, CVE-2027-0077, CVE-2027-0093, CVE-2027-0094, CVE-2027-0118, CVE-2027-0146, CVE-2027-0197, CVE-2027-0199, CVE-2027-0201, CVE-2027-0202, CVE-2027-0208, CVE-2027-0213, CVE-2027-0214, CVE-2027-0217, CVE-2027-0218, CVE-2027-0220, CVE-2027-0222, CVE-2027-0224, CVE-2027-0225, CVE-2027-0226, CVE-2027-0234, CVE-2027-0236, CVE-2027-0239, CVE-2027-0245, CVE-2027-0246, CVE-2027-0251, CVE-2027-0252, CVE-2027-0264, CVE-2027-0265, CVE-2027-0273, CVE-2027-0275
    Original source
  • Nov 7, 2026
    • Date parsed from source:
      Nov 7, 2026
    • First seen by Releasebot:
      Nov 8, 2026
    GrapheneOS logo

    GrapheneOS

    2026110700

    GrapheneOS ships a security preview with Android security patches through May 2027, broad kernel and system fixes, improved location privacy APIs, and an updated Vanadium browser.

    Tags:

    Changes since the 2026110200 release

    All of the Android 17 security patches from the current December 2026, January 2027, February 2027, March 2027, April 2027 and May 2027 Android Security Bulletins are included in the 2026110701 security preview release.

    List of additional fixed CVEs:

    For detailed information on security preview releases, see our .post about it

    (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)2026110700

    • add APIs for requesting coarsened locations for use by Vanadium and the sandboxed Google Play compatibility layer
    • Sandboxed Google Play compatibility layer: switch to added APIs for requesting coarsened locations instead of reimplementing LocationFudger inside GmsCompat
    • overhaul emergency number handling with new infrastructure in adevtool and arsclib for extracting proper data from Safety Hub to replace the outdated and broken AOSP implementation
    • restore setting supplementary groups and NoNewPrivs for native zygote processes with secure spawning (currently primarily used by Vanadium, Chrome and certain other Chromium-based browsers to reduce renderer memory usage)
    • Launcher: extend search filtering added downstream for Private Space to work profiles which are locked or paused
    • update timezone data to 2026f
    • kernel (6.1): activate slab canaries before freeing on bulk allocation failure to avoid triggering BUG and causing a panic (this doesn't impact devices with MTE, was never present in 6.12 or 6.18 and is very rare)
    • kernel (6.18): update to latest GKI LTS branch revision
    • kernel (6.18): backport upstream FUSE use-after-free patch for another FUSE patch backported by the upstream Android GKI branch
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix audio offload compatibility issue with Linux 6.18
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): account for 64-bit counter wraps in compressed audio timestamps (based on a change in the Android 17 QPR2 Beta port of the drivers to Linux 6.12)
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix handling zram initialization failure in the 6.18 port
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix existing upstream bug of missing synchronization for PCIe rescans
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): preserve MSI acknowledgements with hardware affinity for compatibility with new GKI LTS branch update based on the code from Google's QPR2 driver code
    • kernel (microdroid): enable forced module signing (upstream enables modules for 6.12 and 6.18 microdroid kernel builds)
    • kernel (microdroid): replace upstream sha1 module signing with sha256
    • allowlist BROADCAST_CLOSE_SYSTEM_DIALOGS for Dialer which is required for target API 37
    • Vanadium: update to version 157.0.8103.38.0

    Critical

    CVE-2026-28666, CVE-2026-49921, CVE-2026-58820, CVE-2026-59062, CVE-2026-59069, CVE-2026-104172, CVE-2027-0001, CVE-2027-0160, CVE-2027-0165, CVE-2027-0212, CVE-2027-0255, CVE-2027-0279

    High

    CVE-2025-48654, CVE-2026-28611, CVE-2026-28619, CVE-2026-28635, CVE-2026-45523, CVE-2026-47964, CVE-2026-49914, CVE-2026-55260, CVE-2026-55274, CVE-2026-55281, CVE-2026-55284, CVE-2026-58860, CVE-2026-58869, CVE-2026-58872, CVE-2026-58935, CVE-2026-58954, CVE-2026-58958, CVE-2026-58960, CVE-2026-58972, CVE-2026-58973, CVE-2026-58993, CVE-2026-58998, CVE-2026-59013, CVE-2026-59017, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59052, CVE-2026-59053, CVE-2026-59054, CVE-2026-59055, CVE-2026-59056, CVE-2026-59057, CVE-2026-59058, CVE-2026-59059, CVE-2026-59061, CVE-2026-59063, CVE-2026-59064, CVE-2026-59065, CVE-2026-59067, CVE-2026-59068, CVE-2026-59070, CVE-2026-59071, CVE-2026-104154, CVE-2026-104155, CVE-2026-104156, CVE-2026-104157, CVE-2026-104158, CVE-2026-104159, CVE-2026-104160, CVE-2026-104161, CVE-2026-104162, CVE-2026-104163, CVE-2026-104164, CVE-2026-104166, CVE-2026-104167, CVE-2026-104170, CVE-2026-104171, CVE-2027-0002, CVE-2027-0010, CVE-2027-0011, CVE-2027-0012, CVE-2027-0065, CVE-2027-0077, CVE-2027-0093, CVE-2027-0094, CVE-2027-0118, CVE-2027-0146, CVE-2027-0197, CVE-2027-0199, CVE-2027-0201, CVE-2027-0202, CVE-2027-0208, CVE-2027-0213, CVE-2027-0214, CVE-2027-0217, CVE-2027-0218, CVE-2027-0220, CVE-2027-0222, CVE-2027-0224, CVE-2027-0225, CVE-2027-0226, CVE-2027-0234, CVE-2027-0236, CVE-2027-0239, CVE-2027-0245, CVE-2027-0246, CVE-2027-0251, CVE-2027-0252, CVE-2027-0264, CVE-2027-0265, CVE-2027-0273, CVE-2027-0275

    Original source
  • Nov 5, 2026
    • Date parsed from source:
      Nov 5, 2026
    • First seen by Releasebot:
      Nov 6, 2026
    Microsoft logo

    Windows by Microsoft

    What’s new in Windows 365: October 2026 recap

    Windows 365 and Azure Virtual Desktop add more resilient connections, smoother session recovery, stronger identity and redirection controls, flexible Intune settings, automated Cloud PC deprovisioning, and Windows 11 version 26H2 images.

    Welcome back to our monthly roundup of Windows 365 and Azure Virtual Desktop updates, bringing what’s new, why it matters, and how to get started together in one place.

    October’s updates cover connectivity in Azure Government, session continuity for Windows 365 Flex, external identity and redirection controls, and new Intune settings for configuring and targeting Cloud PCs, including Reserve auto-deprovisioning that just lands in public preview.

    Seamless user experience

    A seamless Cloud PC experience means staying connected and picking up work without interruption. This month’s updates focus on making connections more resilient and reconnects smoother.

    RDP Multipath and RDP Shortpath

    In the September recap, we shared that RDP Shortpath with TURN relay and RDP Multipath with TCP paths were rolling out in phases in Azure Government. Both are now generally available. RDP Multipath improves connection resiliency by maintaining multiple network paths and automatically switching to an available path when network conditions change. RDP Shortpath with TURN relay provides relayed UDP connectivity when a direct connection isn’t possible. Together, they help users stay productive with fewer session interruptions, even as network conditions change or direct connections are unavailable.

    For Azure Government, TURN relay uses the dedicated IP range 20.140.236.0/22 over UDP port 3478. Ensure your network configuration allows this range to use RDP Shortpath with TURN relay.

    Session State Retention for Windows 365 Flex in dedicated mode

    Session State Retention for eligible Windows 365 Flex dedicated Cloud PCs (Generally Available) lets users pick up where they left off. Previously, a Flex dedicated Cloud PC powered off when the user disconnected. Now, an eligible Cloud PC hibernates after a set idle period instead, so when users reconnect, their apps and work are just as they left them. Session State Retention works alongside Intelligent pre-start, which learns each user’s sign-in pattern and starts the Cloud PC before they need it. Together, they make connecting and reconnecting faster and more seamless.

    Security and reliability

    A seamless experience also needs secure, flexible access. October’s updates expand access for external users, tighten control over redirections and host pool identities.

    Windows App iOS support for external identities is now generally available

    In the September recap, we shared that Windows App was expanding access for external users with iOS support for external identities in preview. This capability is now generally available. External users, such as contractors, vendors, and partners, can now sign in to their Cloud PCs from Windows App on iPhone or iPad. With this release, external identities are supported in Windows App on Windows, macOS, iOS, and Android, and in a web browser in the commercial cloud.

    Azure Virtual Desktop adds stronger security controls

    Managed identity support for Azure Virtual Desktop host pools (Generally Available) lets IT admins give a host pool its own Azure identity. That identity carries the permissions Azure Virtual Desktop needs to manage virtual machines, key vaults, and networks on the admin’s behalf. Features that use it include session host configuration, autoscale, Start VM on Connect, and Azure Virtual Desktop for Azure Local. Admins can grant each host pool only the access it needs, instead of relying on the shared Azure Virtual Desktop service principal. This gives them a more secure setup with tighter control over permissions. Action required: In a future service update, host pools that use a session host configuration will need a managed identity before you can add session hosts to them. Set one up now to avoid disruption.

    RemoteApp support for context-based redirections (Preview) extends context-based redirections in Azure Virtual Desktop to RemoteApp sessions. Context-based redirections let IT decide when users can use their clipboard, drives, printers, and USB devices in a remote session. The decision is based on Microsoft Entra Conditional Access conditions such as device compliance, user role, or network location. IT configures it once on the host pool, and the policy applies to both desktop and RemoteApp sessions. With this feature, users get the access they need on trusted devices, and sensitive data stays protected everywhere else.

    Easy manageability

    Behind every seamless user experience is an IT team responsible for configuring, deploying, and managing it. October’s updates focus on giving admins more flexibility in how Cloud PCs are configured and targeted, while simplifying common management tasks at scale.

    More flexible Cloud PC Settings in Intune

    Default display settings for Cloud PCs (Generally Available) let IT set a default display experience for Cloud PCs, either a single display or all displays. Users can still override the default with their own display preferences in Windows App, giving IT a consistent starting point while preserving flexibility for individual users.

    At the same time, assign Cloud PC settings to all users or all devices (Public Preview) enables Cloud PC configurations and Windows App settings to target user groups or all users, and remote connection experience settings can target device groups or all devices. This helps IT roll out a consistent baseline across the organization faster, while still allowing group-level targeting where it’s needed.

    New deprovisioning options: Bulk and automated deprovisioning

    Bulk deprovisioning for Windows 365 Enterprise and Windows 365 Flex dedicated Cloud PCs in grace period (Generally Available) lets admins deprovision multiple Windows 365 Enterprise and Flex dedicated Cloud PCs in grace period at once, instead of waiting out the seven-day grace period or ending it one Cloud PC at a time. Admins can start it from the provisioning policy view or the Intune Bulk Action Wizard. This saves time when offboarding users, reorganizing teams, or cleaning up unused Cloud PCs, and reduces the repetitive manual work of removing them one by one.

    Windows 365 Reserve auto-deprovisioning (Public Preview) is an optional setting that automatically deprovisions Reserve Cloud PCs that are provisioned but not actively connected to, based on a threshold configured by the IT admin. Once deprovisioned, the Cloud PCs must be reprovisioned before they can be used again. Any remaining Reserve Cloud PC access days are preserved and can be used after reprovisioning. Like user-initiated provisioning, this feature is disabled by default and fully governed by IT admin. To enable it, IT admins update the Cloud PC configuration settings for Windows 365 Reserve in Microsoft Intune, scope it to specific Microsoft Entra ID user groups, and can update the setting at any time.

    Auto-deprovisioning helps organizations maximize the value of each user’s 10-day Reserve Cloud PC entitlement, so access days aren’t spent on Cloud PCs that sit unused.

    Windows 11, version 26H2 images are now available for Windows 365 and Azure Virtual Desktop

    Windows 11 Enterprise, version 26H2 images are now available for new Cloud PCs and session hosts, so organizations can deploy the latest Windows release from day one.

    • Windows 365: select a 26H2 image from the gallery in your provisioning policy. The options are Windows 11 Enterprise 26H2, Windows 11 Enterprise + Microsoft 365 Apps 26H2, and Windows 11 Enterprise Developer Configuration + Microsoft 365 Apps 26H2.
    • Azure Virtual Desktop: deploy session hosts from the Windows 11 Enterprise 26H2 or Windows 11 Enterprise + Microsoft 365 Apps 26H2 images in Azure Marketplace.

    Partner news

    EfficientEther helps IT teams and partners migrate to Windows 365 and manage Cloud PCs afterwards, using EtherInsights for sizing, cost and idle machines and EtherApps Forge to package legacy apps as MSIX. Free MSIX and EtherApps Forge training and certification is at etherapps.ai/training, and the new Windows 365 management pages are at efficientether.co.uk and https://efficientether.co.uk/products/etherinsights/windows-365.

    Documentation updates

    A good experience also depends on clear guidance for the IT teams who deploy and manage it. This month’s documentation updates add requirements for Azure storage accounts used with Windows 365, and bring context-based redirection guidance for Windows 365 and Azure Virtual Desktop into one place.

    Understand Azure storage requirements for Windows 365

    A new Requirements for Azure storage accounts used with Windows 365 article outlines requirements for storage accounts used by Windows 365 features that copy Cloud PC snapshots to customer Azure storage accounts, including scenarios such as digital forensics, compliance, and disaster recovery.

    Configure context-based redirections

    The Configure context-based redirections article has been updated to bring Windows 365 and Azure Virtual Desktop guidance together in one resource. It includes updated guidance and screenshots for configuring context-based redirections using Microsoft Entra authentication context.

    Continue the conversation at Microsoft Ignite. Join us November 17–20 in San Francisco or online to explore the latest Windows innovations, connect with the experts behind them, and go deeper with sessions, demos, and hands-on experiences. Then, keep the conversation going: join the Windows Tech Community and follow Windows IT Pro for the latest updates, insights, and best practices.

    Original source
  • November 2026
    • No date parsed from source.
    • First seen by Releasebot:
      Nov 4, 2026
    Apple logo

    macOS by Apple

    macOS 27.3 Golden Gate Beta Release Notes

    macOS releases the 27.3 SDK for the Golden Gate beta, adding DriverKit and SCSI controller capabilities, NEURLFilter updates, and multiseat subscriptions in StoreKit. The update also fixes issues with Linux booting and speech capture, while noting changes and known issues across system frameworks.

    Update your apps to use new features, and test your apps against API changes.

    Overview

    The macOS 27.3 SDK provides support to develop apps for Mac computers running macOS 27.3 Golden Gate beta. The SDK comes bundled with Xcode 27.3. For information on the compatibility requirements for Xcode 27.3, see Xcode 27.3 Release Notes.

    DriverKit

    New Features

    • DriverKit 27.3 adds IOUserSCSIParallelInterfaceController::UserCopyDataBuffer, which supersedes the deprecated UserGetDataBuffer and has the same API interface. UserCopyDataBuffer returns the buffer at +1, so you must release it when you finish. (190089334)

    Deprecations

    • IOUserSCSIParallelInterfaceController::UserGetDataBuffer is deprecated in DriverKit 27.3 because it leaks memory. Use UserCopyDataBuffer instead. UserCopyDataBuffer returns the buffer at +1, so you must release it when you finish. (184905119) (FB24326124)

    mBoot

    Resolved Issues

    • Fixed: Only a single core is available when you boot Linux or other third-party operating systems from a custom raw boot object on Mac computers with M5 Pro, M5 Max, and M5 Ultra chips. (182898702) (FB23916610)

    NEURLFilter

    New Features

    • The system now keeps a set of unused evaluation keys uploaded to your NEURLFilter PIR service, and when it runs out of pre-uploaded keys, it automatically falls back to sending a fresh evaluation key inline with the query. When a query includes an evaluation key, your service must use it directly instead of looking one up by the user identifier. (187726173)

    Deprecations

    • NEURLFilter no longer supports user tiers. The system no longer calls your service’s /token-key-for-user-token endpoint and instead uses the first valid public key in your Privacy Pass token issuer directory. (191651440)
    • NEURLFilter now limits a service’s PIR configuration to at most 65,536 shards and requires the shard count to be a power of two, for example, 256, 512, 1024, or 2048. The system rejects a configuration that exceeds the limit or whose shard count isn’t a power of two. Configurations that already meet both constraints work with earlier releases and need no changes. (191651462)
    • Your NEURLFilter service URL and Privacy Pass issuer URL must now be declared statically in your app’s Info.plist, and providing them only at runtime is deprecated. Add an NSPIRConfiguration dictionary to your app’s Info.plist (not the URL filter extension’s) with a PIRServerURL key and a PrivacyPassIssuerURL key. PIRServerURL corresponds to pirServerURL, and PrivacyPassIssuerURL corresponds to pirPrivacyPassIssuerURL and defaults to PIRServerURL when absent. Each value should contain only the host name of your server. If you also set these values at runtime, they must match the Info.plist values exactly, or the system fails to start the filter with an invalid configuration error. (191651632)

    Rosetta

    Deprecations

    • macOS now notifies users when an audio plug-in or print dialog extension that requires Rosetta is used, and lists these plug-ins in the Intel-based apps list in General settings. To avoid the notification, check with the developer for an Apple silicon version of the plug-in or extension. (180686443)
    • macOS now notifies you when you print using a printer driver that requires Rosetta but is not yet updated for Apple silicon. macOS also prompts you to install Rosetta if it isn’t already installed. To avoid notifications, use AirPrint, which is built into most printer models and requires no additional driver installation, or contact the driver developer to learn whether an update for Apple silicon is available or planned. (188594616)

    SCSIControllerDriverKit

    New Features

    • SCSIControllerDriverKit now supports software controllers. A software controller declares itself by setting kIOPropertySoftwareIOKey (an OSBoolean, from <IOKit/storage/IOStorageControllerCharacteristics.h>) through UserSetHBAProperties(). The system honors this setting only before controller initialization completes, so it stays fixed for the life of the controller. Such a controller doesn’t create any DMA mappings, and your dext can access the data buffer associated with a particular I/O through the UserCopyDataBuffer API. (182426393) (FB23797269)

    Siri

    Known Issues

    • On macOS, Siri cannot find app entities donated to Spotlight by third-party apps unless those entities conform to a schema. (191273925)

    Speech

    Resolved Issues

    • Fixed: An assertion failure occurs when you use CaptureInputSequenceProvider in a “Mac (Designed for iPad)” target. (187921017) (FB24862729)

    StoreKit

    New Features

    • Multiseat subscriptions let a customer purchase multiple seats for an auto-renewable subscription and invite others to join it. Check whether a subscription supports multiseat purchases through the new supportsMultiSeatPurchase property on Product and AdvancedCommerceProduct, which reflects the setting you configure in App Store Connect. (164581840)

    StoreKit Testing in Xcode

    Resolved Issues

    • Fixed: Making an in-app purchase for a subscription that is a member of a subscription bundle incorrectly allows the user to unbundle instead of throwing an error. (186018916)

    Known Issues

    • When you launch an app that uses SKTestSession for the first time, some StoreKit Test API calls might hang. (186670057) (FB24651858)

    Workaround: Set a StoreKit configuration file in your scheme’s run options, then rerun the tests.

    Original source
  • November 2026
    • No date parsed from source.
    • First seen by Releasebot:
      Nov 4, 2026
    Apple logo

    iOS by Apple

    iOS & iPadOS 27.3 Beta Release Notes

    iOS ships the 27.3 beta SDK with support for developing and testing apps, plus StoreKit multiseat subscriptions that let customers buy seats and invite others. Updates also refine Live Caller ID Lookup and NEURLFilter evaluation key handling and configuration requirements.

    Update your apps to use new features, and test your apps against API changes.

    Overview

    The iOS & iPadOS 27.3 SDK provides support to develop apps for iPhone and iPad running iOS & iPadOS 27.3 beta. The SDK comes bundled with Xcode 27.3. For information on the compatibility requirements for Xcode 27.3, see Xcode 27.3 Release Notes.

    App Intents

    Known Issues

    • If you define authentication Policy on an App Entity or App Entity property that requires unlock, Siri AI might not request an unlock before it displays these entities. (190573761)

    Live Caller ID Lookup

    New Features

    • The system now keeps a set of unused evaluation keys uploaded to your Live Caller ID Lookup service, and when it runs out of pre-uploaded keys, it automatically falls back to sending a fresh evaluation key inline with the query. When a query includes an evaluation key, your service must use it directly instead of looking one up by the user identifier. (187726157)

    Deprecations

    • Live Caller ID Lookup now requires the shard count in a service’s PIR configuration to be a power of two, for example 256, 512, 1024, or 2048. The system rejects a configuration whose shard count isn’t a power of two. Configurations that already use a power-of-two shard count work with earlier releases and need no changes. (191651833)

    NEURLFilter

    New Features

    • The system now keeps a set of unused evaluation keys uploaded to your NEURLFilter PIR service, and when it runs out of pre-uploaded keys, it automatically falls back to sending a fresh evaluation key inline with the query. When a query includes an evaluation key, your service must use it directly instead of looking one up by the user identifier. (187726173)

    Deprecations

    • NEURLFilter no longer supports user tiers. The system no longer calls your service’s /token-key-for-user-token endpoint and instead uses the first valid public key in your Privacy Pass token issuer directory. (191651440)
    • NEURLFilter now limits a service’s PIR configuration to at most 65,536 shards and requires the shard count to be a power of two, for example, 256, 512, 1024, or 2048. The system rejects a configuration that exceeds the limit or whose shard count isn’t a power of two. Configurations that already meet both constraints work with earlier releases and need no changes. (191651462)
    • Your NEURLFilter service URL and Privacy Pass issuer URL must now be declared statically in your app’s Info.plist, and providing them only at runtime is deprecated. Add an NSPIRConfiguration dictionary to your app’s Info.plist (not the URL filter extension’s) with a PIRServerURL key and a PrivacyPassIssuerURL key. PIRServerURL corresponds to pirServerURL, and PrivacyPassIssuerURL corresponds to pirPrivacyPassIssuerURL and defaults to PIRServerURL when absent. Each value should contain only the host name of your server. If you also set these values at runtime, they must match the Info.plist values exactly, or the system fails to start the filter with an invalid configuration error. (191651632)

    StoreKit

    New Features

    • Multiseat subscriptions let a customer purchase multiple seats for an auto-renewable subscription and invite others to join it. Check whether a subscription supports multiseat purchases through the new supportsMultiSeatPurchase property on Product and AdvancedCommerceProduct, which reflects the setting you configure in App Store Connect. (164581840)

    Resolved Issues

    • Fixed: If you test Ask to Buy in the Sandbox environment while signed in to an iCloud account that is a member of a Family Sharing group, you might be unable to view or approve sandbox Ask to Buy requests. (190639717)

    StoreKit Testing in Xcode

    Resolved Issues

    • Fixed: Making an in-app purchase for a subscription that is a member of a subscription bundle incorrectly allows the user to unbundle instead of throwing an error. (186018916)

    Known Issues

    • When you launch an app that uses SKTestSession for the first time, some StoreKit Test API calls might hang. (186670057) (FB24651858)

    Workaround: Set a StoreKit configuration file in your scheme’s run options, then rerun the tests.

    Original source
  • Nov 2, 2026
    • Date parsed from source:
      Nov 2, 2026
    • First seen by Releasebot:
      Nov 4, 2026
    GrapheneOS logo

    GrapheneOS

    2026110200

    GrapheneOS ships a security preview with Android 17 patches from five security bulletins, fixes numerous critical and high-severity vulnerabilities, and addresses kernel regressions and Pixel 10 charging issues.

    Tags:

    Changes since the 2026110100 release:

    All of the Android 17 security patches from the current December 2026, January 2027, February 2027, March 2027 and April 2027 Android Security Bulletins are included in the 2026110201 security preview release. List of additional fixed CVEs:

    For detailed information on security preview releases, see our .post about it

    (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)2026110200

    full 2026-11-01 security patch level

    • kernel (6.1): apply patch for MGLRU null pointer dereference regression from Android GKI branch
    • kernel (6.1): apply patch for page migration infinite loop from Android GKI branch
    • kernel (6.1): backport upstream Linux patches for USB HID regressions
    • kernel (6.1): backport upstream Linux patch for fscrypt regression causing data race
    • kernel (6.1): backport upstream Linux patch for MIDI use-after-free regression
    • kernel (6.1): backport upstream Linux patch for USB HID use-after-free regression
    • kernel (6.1): backport upstream Linux patch for block crypto use-after-free and null pointer dereference regression
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): add support for new AVS charging types to the Pixel power supply charging logging code to avoid invalid memory access caught by UBSan and also improve the code to be robust against similar issues in the future
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix PPS fast charging for chargers supporting AVS
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): restore writable hysteresis for zones with a callback to allow userspace to configure it again (in practice, the HAL raises it from 1C to 2.9C and reduces thermal interrupts which may save a bit of power)
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): account for cpufreq pressure in CPU-fit checks (this was a very minor scheduler optimization regression in the port to 6.18 which is also present in Google's port to 6.12 in Android 17 QPR2 Beta)
    • adevtool: improve process-bulletin-patches command

    List of additional fixed CVEs:

    • Critical: CVE-2026-49921, CVE-2026-58820, CVE-2026-59062, CVE-2026-59069, CVE-2027-0001, CVE-2027-0160, CVE-2027-0165, CVE-2027-0212
    • High: CVE-2026-28619, CVE-2026-28635, CVE-2026-45523, CVE-2026-47964, CVE-2026-49914, CVE-2026-55260, CVE-2026-55274, CVE-2026-55281, CVE-2026-55284, CVE-2026-58860, CVE-2026-58869, CVE-2026-58872, CVE-2026-58935, CVE-2026-58954, CVE-2026-58958, CVE-2026-58960, CVE-2026-58972, CVE-2026-58973, CVE-2026-58993, CVE-2026-58998, CVE-2026-59013, CVE-2026-59017, CVE-2026-59023, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59052, CVE-2026-59053, CVE-2026-59054, CVE-2026-59055, CVE-2026-59056, CVE-2026-59057, CVE-2026-59058, CVE-2026-59059, CVE-2026-59061, CVE-2026-59063, CVE-2026-59064, CVE-2026-59065, CVE-2026-59067, CVE-2026-59068, CVE-2026-59070, CVE-2026-59071, CVE-2026-104154, CVE-2026-104155, CVE-2026-104156, CVE-2026-104157, CVE-2026-104158, CVE-2026-104159, CVE-2026-104160, CVE-2026-104161, CVE-2026-104162, CVE-2026-104163, CVE-2026-104164, CVE-2026-104166, CVE-2026-104167, CVE-2026-104170, CVE-2026-104171, CVE-2027-0002, CVE-2027-0010, CVE-2027-0011, CVE-2027-0012, CVE-2027-0065, CVE-2027-0077, CVE-2027-0093, CVE-2027-0094, CVE-2027-0118, CVE-2027-0146, CVE-2027-0197, CVE-2027-0199, CVE-2027-0201, CVE-2027-0202, CVE-2027-0208, CVE-2027-0213, CVE-2027-0214, CVE-2027-0217, CVE-2027-0218, CVE-2027-0220, CVE-2027-0222, CVE-2027-0224, CVE-2027-0225, CVE-2027-0226, CVE-2027-0234, CVE-2027-0236, CVE-2027-0239
    Original source
  • Nov 2, 2026
    • Date parsed from source:
      Nov 2, 2026
    • First seen by Releasebot:
      Nov 3, 2026
    Google logo

    Android by Google

    Google Messages, Phone by Google, and Google Contacts get new, updated icons.

    Android brings a sleeker, more cohesive look to the Messages, Phone, and Contacts icons.

    Google is updating the icons for Messages, Phone, and Contacts with a sleeker, cohesive design. See the new look for your home screen.

    Original source
  • Nov 1, 2026
    • Date parsed from source:
      Nov 1, 2026
    • First seen by Releasebot:
      Nov 3, 2026
    GrapheneOS logo

    GrapheneOS

    2026110100

    GrapheneOS releases a security preview with Android security patches through April 2027, working satellite cellular support, and extensive kernel and system fixes. The update also improves Pixel 10 support and resolves app compatibility issues.

    Tags

    Changes since the 2026102100 release

    • All of the Android 17 security patches from the current November 2026, December 2026, January 2027, February 2027, March 2027 and April 2027 Android Security Bulletins are included in the 2026110101 security preview release. List of additional fixed CVEs:
    • For detailed information on security preview releases, see our .post about it
    • (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)2026110100
    • add working support for satellite-based cellular service avoiding the previous issues which caused Android Auto to be partially broken due to malfunctioning APIs (confirmed to work with the T-Satellite service from T-Mobile)
    • disable buggy defer_service_restart_when_frozen flag due to it breaking handling of service restarts for frozen service clients
    • run previously missed post-spawning cleanup for secure (exec) spawning with the native zygote to avoid leaving signals blocked (in practice, this is only used by a subset of Chromium-based browsers including Vanadium to spawn sandboxed renderers as more lightweight native processes and will also be used for the WebView soon)
    • SystemUI: fix an upstream Android use-after-free bug in PipTouchHandler
    • add fix for remote denial of service vulnerability from the November 2026 security bulletin to the regular releases which has been fixed in our security preview releases since July 2026
    • Sandboxed Google Play compatibility layer: fix an IThirdPartyPayService GmsCore crash
    • Launcher: fix upstream bug breaking home screen accessibility actions
    • kernel (6.18): fix compatibility issues between slab canaries and sheaf allocation added in 6.18
    • kernel (6.18): re-enable AutoFDO function splitting optimization since both clang and rustc include the necessary LLVM bug fix for it which was missing for the Android 6.12 kernel toolchain
    • kernel (6.18): use the Rust implementation of Binder instead of the legacy C implementation
    • kernel (6.18): switch lockdown for the main Android kernel to integrity mode since DMA-BUF statistics now use a BPF program incompatible with confidentiality mode instead of the now deprecated sysfs interface compatible with it (microdroid kernel still uses confidentiality mode)
    • kernel (6.18): selinux: add initialized check to security_sid_to_context_type_core to guard against a theoretical issue
    • kernel (6.18): fix upstream block-layer races causing kernel crashes and incorrect I/O statistics
    • kernel (6.18): fix upstream pKVM IOMMU allocation and retry handling bugs, including a hang during recovery sideloading
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): port all the drivers to the 6.18 kernel branch and switch to it
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream bug breaking recovery from cellular radio boot failures
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream pKVM/SMMU bugs in DMA mapping, error handling and timeout detection
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream memory lifetime bugs in interconnect, CPM tracing and subsystem crash dump drivers
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream initialization, cleanup and error handling bugs in USB charging, display, touch, input, TPU and SoC information drivers
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream callback lifetime bugs in UFS, battery monitoring and modem drivers during initialization failure and cleanup
    • kernel (Pixel): stop building with LTO since kCFI doesn't require it, the Pixel OS stopped using it and it's incompatible with newer kernel branches due to Rust + BTF + LTO not being supported together
    • kernel (6.1, 6.6, 6.12, 6.18): fix handling edge cases for GrapheneOS SELinux extension auditing code
    • kernel (6.1, 6.6, 6.12, 6.18): backport patch for CVE-2026-98432 (MPTCP was already disabled in all of the kernels along with having defenses including MTE)
    • kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.182
    • kernel (6.1): backport 6 patches from later LTS releases to fix regressions caused by the currently included LTS patches
    • kernel (6.6): update to latest GKI LTS branch revision
    • kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.97
    • kernel (6.18): update to latest GKI LTS branch revision including update to 6.18.38
    • kernel (generic): enable stamping build with Git commit metadata as is already done for Pixel and microdroid kernel builds
    • add explicit preloading of Build.VERSION in the zygote process as a replacement for the SELinux policy change in the fixing Cuttlefishprevious release
    • revert marking CredentialSelectorActivity opaque as an added GrapheneOS security protection due to app compatibility issues
    • Sandboxed Google Play compatibility layer: revert marking FIDO activities as opaque as an added GrapheneOS security protection due to app compatibility issues
    • App Store: update to version 37
    • Messaging: update to version 17
    • Messaging: update to version 18
    • Vanadium: update to version 156.0.8078.73.0
    • Vanadium: update to version 156.0.8078.79.0
    • TalkBack: update to version 23
    • GmsCompatConfig: update to version 178
    • Thread network: grant network access to the HAL and simulated Radio Co-Processor (RCP) used for testing in Cuttlefish to avoid breaking the tests
    • adevtool: process-kernel-tarballs: add support for tarball-per-target format

    List of additional fixed CVEs

    • Critical: CVE-2026-49921, CVE-2026-58814, CVE-2026-58820, CVE-2026-58868, CVE-2026-58876, CVE-2026-58984, CVE-2026-59062, CVE-2026-59069, CVE-2027-0001, CVE-2027-0160, CVE-2027-0165
    • High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28619, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-45523, CVE-2026-47964, CVE-2026-49914, CVE-2026-49935, CVE-2026-55260, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58997, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59052, CVE-2026-59053, CVE-2026-59054, CVE-2026-59055, CVE-2026-59056, CVE-2026-59057, CVE-2026-59058, CVE-2026-59059, CVE-2026-59061, CVE-2026-59063, CVE-2026-59064, CVE-2026-59065, CVE-2026-59067, CVE-2026-59068, CVE-2026-59070, CVE-2026-59071, CVE-2026-104154, CVE-2026-104155, CVE-2026-104156, CVE-2026-104157, CVE-2026-104158, CVE-2026-104159, CVE-2026-104160, CVE-2026-104161, CVE-2026-104162, CVE-2026-104163, CVE-2026-104164, CVE-2026-104166, CVE-2026-104167, CVE-2026-104170, CVE-2026-104171, CVE-2027-0002, CVE-2027-0010, CVE-2027-0011, CVE-2027-0012, CVE-2027-0065, CVE-2027-0077, CVE-2027-0093, CVE-2027-0094, CVE-2027-0197, CVE-2027-0199⊕final_payload start### Tags

    Changes since the 2026102100 release

    All of the Android 17 security patches from the current November 2026, December 2026, January 2027, February 2027, March 2027 and April 2027 Android Security Bulletins are included in the 2026110101 security preview release. List of additional fixed CVEs:

    For detailed information on security preview releases, see our .post about it

    (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)2026110100

    • add working support for satellite-based cellular service avoiding the previous issues which caused Android Auto to be partially broken due to malfunctioning APIs (confirmed to work with the T-Satellite service from T-Mobile)
    • disable buggy defer_service_restart_when_frozen flag due to it breaking handling of service restarts for frozen service clients
    • run previously missed post-spawning cleanup for secure (exec) spawning with the native zygote to avoid leaving signals blocked (in practice, this is only used by a subset of Chromium-based browsers including Vanadium to spawn sandboxed renderers as more lightweight native processes and will also be used for the WebView soon)
    • SystemUI: fix an upstream Android use-after-free bug in PipTouchHandler
    • add fix for remote denial of service vulnerability from the November 2026 security bulletin to the regular releases which has been fixed in our security preview releases since July 2026
    • Sandboxed Google Play compatibility layer: fix an IThirdPartyPayService GmsCore crash
    • Launcher: fix upstream bug breaking home screen accessibility actions
    • kernel (6.18): fix compatibility issues between slab canaries and sheaf allocation added in 6.18
    • kernel (6.18): re-enable AutoFDO function splitting optimization since both clang and rustc include the necessary LLVM bug fix for it which was missing for the Android 6.12 kernel toolchain
    • kernel (6.18): use the Rust implementation of Binder instead of the legacy C implementation
    • kernel (6.18): switch lockdown for the main Android kernel to integrity mode since DMA-BUF statistics now use a BPF program incompatible with confidentiality mode instead of the now deprecated sysfs interface compatible with it (microdroid kernel still uses confidentiality mode)
    • kernel (6.18): selinux: add initialized check to security_sid_to_context_type_core to guard against a theoretical issue
    • kernel (6.18): fix upstream block-layer races causing kernel crashes and incorrect I/O statistics
    • kernel (6.18): fix upstream pKVM IOMMU allocation and retry handling bugs, including a hang during recovery sideloading
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): port all the drivers to the 6.18 kernel branch and switch to it
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream bug breaking recovery from cellular radio boot failures
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream pKVM/SMMU bugs in DMA mapping, error handling and timeout detection
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream memory lifetime bugs in interconnect, CPM tracing and subsystem crash dump drivers
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream initialization, cleanup and error handling bugs in USB charging, display, touch, input, TPU and SoC information drivers
    • kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): fix upstream callback lifetime bugs in UFS, battery monitoring and modem drivers during initialization failure and cleanup
    • kernel (Pixel): stop building with LTO since kCFI doesn't require it, the Pixel OS stopped using it and it's incompatible with newer kernel branches due to Rust + BTF + LTO not being supported together
    • kernel (6.1, 6.6, 6.12, 6.18): fix handling edge cases for GrapheneOS SELinux extension auditing code
    • kernel (6.1, 6.6, 6.12, 6.18): backport patch for CVE-2026-98432 (MPTCP was already disabled in all of the kernels along with having defenses including MTE)
    • kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.182
    • kernel (6.1): backport 6 patches from later LTS releases to fix regressions caused by the currently included LTS patches
    • kernel (6.6): update to latest GKI LTS branch revision
    • kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.97
    • kernel (6.18): update to latest GKI LTS branch revision including update to 6.18.38
    • kernel (generic): enable stamping build with Git commit metadata as is already done for Pixel and microdroid kernel builds
    • add explicit preloading of Build.VERSION in the zygote process as a replacement for the SELinux policy change in the fixing Cuttlefishprevious release
    • revert marking CredentialSelectorActivity opaque as an added GrapheneOS security protection due to app compatibility issues
    • Sandboxed Google Play compatibility layer: revert marking FIDO activities as opaque as an added GrapheneOS security protection due to app compatibility issues
    • App Store: update to version 37
    • Messaging: update to version 17
    • Messaging: update to version 18
    • Vanadium: update to version 156.0.8078.73.0
    • Vanadium: update to version 156.0.8078.79.0
    • TalkBack: update to version 23
    • GmsCompatConfig: update to version 178
    • Thread network: grant network access to the HAL and simulated Radio Co-Processor (RCP) used for testing in Cuttlefish to avoid breaking the tests
    • adevtool: process-kernel-tarballs: add support for tarball-per-target format

    List of additional fixed CVEs

    • Critical: CVE-2026-49921, CVE-2026-58814, CVE-2026-58820, CVE-2026-58868, CVE-2026-58876, CVE-2026-58984, CVE-2026-59062, CVE-2026-59069, CVE-2027-0001, CVE-2027-0160, CVE-2027-0165
    • High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28619, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-45523, CVE-2026-47964, CVE-2026-49914, CVE-2026-49935, CVE-2026-55260, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58997, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59052, CVE-2026-59053, CVE-2026-59054, CVE-2026-59055, CVE-2026-59056, CVE-2026-59057, CVE-2026-59058, CVE-2026-59059, CVE-2026-59061, CVE-2026-59063, CVE-2026-59064, CVE-2026-59065, CVE-2026-59067, CVE-2026-59068, CVE-2026-59070, CVE-2026-59071, CVE-2026-104154, CVE-2026-104155, CVE-2026-104156, CVE-2026-104157, CVE-2026-104158, CVE-2026-104159, CVE-2026-104160, CVE-2026-104161, CVE-2026-104162, CVE-2026-104163, CVE-2026-104164, CVE-2026-104166, CVE-2026-104167, CVE-2026-104170, CVE-2026-104171, CVE-2027-0002, CVE-2027-0010, CVE-2027-0011, CVE-2027-0012, CVE-2027-0065, CVE-2027-0077, CVE-2027-0093, CVE-2027-0094, CVE-2027-0197, CVE-2027-0199
    Original source