Google's September security update has three patch levels

For more than a year now, Google has been addressing security on Android through monthly updates. These updates are provided to Google's partners 30 days before being released to Nexus, Pixel, and Android One hardware in hopes that all of Android can be more secure every month. Despite these efforts, many Android phones still lack regular security updates. September 6th marks not only a new month for Google's security patch program, but a new step in further simplifying the security patch so more phones and tablets can remain up to date.

September's security patch levels will look like this:

  • 2016-09-01 — patches for a pair of Critical remote code execution vulnerabilities, many serious Elevation of Privilege vulnerabilities, several Information Disclosure vulnerabilities, and a pair of Denial of Service vulnerabilities all within Android itself.
  • 2016-09-05 — Everything in the 2016-09-01 patch, as well as patches for several kernel related Elevation of Privilege vulnerabilities, many Qualcomm driver-related vulnerabilities, and Elevation of privilege vulnerabilities found in other third-party drivers.
  • 2016-09-06 — Everything in the 2016-09-01 and 2016-09-05 patches, as well as a fix for a Critical Elevation of Privilege vulnerability in the kernel shared memory subsystem and a fix for a vulnerability in a Qualcomm networking component.

Obviously the September 6th patch level will make your phone or tablet the most secure, but breaking up the patches into specific categories like this makes it easier for many manufacturers to release something. Google's report reminds everyone that there have been no reported cases of active exploits using any of the vulnerabilities fixed in these patches, but these are all still incredibly important additions to Android itself and should be installed as soon as possible. If you have a Nexus, Pixel, Android One, or BlackBerry Android phone you'll see this update arrive shortly through and Over the Air update. If you'd prefer to install that update on a Nexus right now, you can find the images on Google's Developer Site.

For every other manufacturer, we'll have to wait and see which patch level is offered in their update!

Russell is a Contributing Editor at Android Central. He's a former server admin who has been using Android since the HTC G1, and quite literally wrote the book on Android tablets. You can usually find him chasing the next tech trend, much to the pain of his wallet. Find him on Facebook and Twitter

  • Still no 7.0 image for the 6P, so there's nothing to update here. Strange.
  • My assumption is that the 6P release had a lot of randomly reported battery issues etc that they were going to address it in the Sept patch...that's why they didn't post it.
  • I hope it's the same for the Nexus 6 because there is no image for me either and I'm running out of patience lol
  • Enrol for the android beta program you get the update almost immediately. Just did my update 4hrs ago.
  • Unless something has changed very recently, this will only get you the final beta release. If you look at your build number, I think you will find that you are running NPD90G not NRD90M.
  • I updated through the beta program and am running build NRD90M. Nexus 6P.
  • Got the final build
  • What final build. ?
  • I think the same happened with android one . Remember last year m update ? There was reportedly battery draining issue . I think that is why they are delaying the update .
  • Yup, there is an updated Marshmallow image for the 6P which includes the September security updates. Makes me think that Nougat may not be coming anytime soon to our 6P's. I read earlier that there may be an issue with the Snapdragon 810. At this point it wouldn't surprise me if Google kicks the 6P to the curb.
  • Eh, I wouldn't knee-jerk so negatively. I have the beta on my 6P (did the enroll/install/unenroll/hard reset trick). It works very well, no issues to report. I know the internet is all pissy about battery life and system usage, but after a factory reset after the OTA to 7.0, it's just fine for me.
  • Wow kick 6P to the curb lol lol are you serious
  • No issues here I'm running 7.0 on my 6p it runs great, why not enroll in beta then get the OTA then unenroll?
  • Not to worry folk's the 6p will be updated to nougat,i have it running on my 6p through beta and there's no issue's with it at all,just keep the Faith.
  • Strange to say, but my asus ZenFone 2, that is still running 5.0, has Sept patch already... and has gotten them the 3 months in a row, and only missed June's.
  • Yes, and on mine it's the September 5th patch. I also downloaded and installed the 6.0.1 update for my ZenFone 2. It's available on their website.
  • ZF2 has 6.0.1 now and on the Sept 5th security patch. I'd hold off on the upgrade to Masrhmellow if you can't handle lack of sd on app support and it "seems" so far I'm getting spottier signal (not weaker).
  • Good move by Google. The easier they make it for manufacturers to provide updates, the more likely we'll be to get them. My S7 Edge is still on July!
  • What carrier do you have? I just got the August 1st update...on September 1st.
  • Unlocked from the UK.
  • My AT&T Note 5 has been on the August security patch for a few weeks now
  • You're lucky. My Rogers Note 5 is still on April patch.
  • Just checked for updates on my GS7 and received the 1 Sept patch level. Unlocked UK phone.
  • Yes, just downloading it now!
  • Seems like we get patches every other month in the UK, can't complain though as at least we are still getting them regularly.
  • Unlocked mxpe still on may, got it in June...
  • Off topic, I just was reading about Tmo will be introducing an enhanced version of lte in the coming months,sweet.
    Unlike verizons version, Tmo has unlimited so u don't have to worry about blowing through your data caps that much faster.
    Tmo ftw as always
  • It's not really unlimited if you're limited to 480p video and capped at 23GB.
  • Sidebar coming up. Nah not capped at 23gigs. Sure if you're on a congested tower they reserve the right to slow you down, but don't try to say it's cut off.
  • Yeah, I'd still call it a "limit" technically, but I've gotten into the 30GB range, and I didn't notice any practical difference. I was still able to stream HD video in major downtown areas (Philly, Chicago, and Boston, maybe a few more) without any issues.
  • No Nexus 6P.... suspicious
  • I can not freaking wait for the new Google Non-Nexus/Pixel devices. I also hope the crafty SOB's over at XDA will have some flash able shizz to make our Nexus 6p's in to or near the new Google devices. Because I'm still REALLY digging this 128 gig Nexus 6p with its 2 year Nexus Protect Program on it. I'm perfectly content with the 6p's hardware unless Google has something up their sleeve no one sees coming. Then I gotta jump to the new device.
  • Keep 6p and pick up the 2018 pixel
  • Oh goodie, more fragmentation
  • How is it fragmentation?
  • Because now we'll have manufacturers' devices, not only on different versions of Android, but different security update levels. So this change adds an additional level of fragmentation. So is your device on L, M, or N? And which month's security update? And which level of monthly security update? So when a particular vulnerability is discovered, instead of having security in having the 'latest' monthly patch, you still have to wonder if you're actually protected from that specific vulnerability. While I appreciate Google's willingness to provide accommodations, I think this change will do more harm and confusion than good.
  • No you won't. See my post below, OEM's will take the patch that applies specifically to their hardware and incorporate it in an update. They're all still the September update.
  • They should all be on the September update but they aren't. I'm on t-mobile with the galaxy s7 edge and the last update i got from them is the July update. By the time T-mobile releases the Sept update the oct or November update will probably be out for everyone else.
  • I actually see this as harder on the manufacturers. Since one monthly update was already too hard for manufacturers to keep up with, Google introduced two patches per month and that did not seem to make it any easier for anyone... now they are doing three patches per month. If one patch per month was already too hard, what makes Google think 3 will be easier?
  • How is the harder for manufacturers. They can simply use the latest build. That is, of course if that manufacturer actually processes these patches in this first place.
  • Manufacturers aren't going to be rolling out the three updates separately. They'll incorporate the appropriate update for their hardware and roll that out. For example, if an OEM doesn't use Qualcomm chips or modems, they don't need to worry about the fixes specific to Qualcomm hardware and can incorporate the "base" update dated 1 September. If the OEM uses specific hardware that is addressed in the later patches, they only need to compile the latest patch ONCE, since the later patch includes the fixes from the 1 September patch. TL/DR: OEM's only need to compile one patch.
  • You're right, they do only need to roll out one patch... the problem is THEY CANT/DONT DO IT. So again, how is making 3 updates available a month easier for manufacturers when one is already "too hard" for them?
  • Because one of them will be easier (or just more applicable) than the other two for the OEM to apply and distribute. Which one that is will be different depending on the device the OEM is updating. The process of making the decision of which to use is not likely to require any significant amount of time or resources.
  • Because they don't need to compile three separate apps, they still only need to worry about one.
  • I still haven't got the August patch on my S7 Edge.
  • How do you get the patches when you're rooted with custom recovery since you can't get ota updates? Is there any way to apply the patches manually? Posted via the Android Central App
  • You'll have to download the OTA file (XDA or similar sites usually host them), then apply it by opening your recovery, clicking "install", then clicking the file. It'll apply the patches and you won't lose any data since it's not overwriting the userdata partition.
  • Question, since u seem to be knowledgeable about this.
    I have an original kindle fireHD 7" tablet. I rooted it and moved/deleted the file that allows the ota updates. I can't figure out what I did with it.
    Can I do the same thing u just recommended to this guy? Does XDA provide updates for the kindle?
    Idk if it ever saw an update.
    It's the ad version kindle, where the lockscreen acts as an advertisement page.
    I have searched the Internet for answers and coming up with nothing on this. I fuqed up when I misplaced the ota file
  • I don't know the specifics of that device since I've never used a Fire tablet, but poke around on XDA. I'm sure someone on there has run into the same problem and can help you.
  • Flashfire FTW.
  • Got the security update on my Dtek50 already. Viva Blackberry.
  • Me too
  • And I'm still waiting for the 7.0 OTA to hit my 6P...
  • It seems like there's some sort of issue with the 6P, since they haven't posted the factory image for it either. They're rolling out a new Marshmallow build for the 6P with these fixes.
  • Hopefully it's because they are working on this insane battery drain that is affecting the 6p with Android N. I don't like this phone.
  • My Blackberry Priv is fully patched, I love the fact that they have kept their promise and monthly updates have been released on time.
  • Yeah.. I have a nice shiny nexus phone and I'm still on the July patch cause apparently, people telling me updates were quick with a Nexus phone lied to me. I'm honestly just Pissed at this point. I gave up my sd card and removable battery for quick updates and phones not supported by Google get security patches faster than me. What the hell?
  • What phone is it?
  • N6
  • Did you buy it from a carrier? Or unlocked from Google or Motorola?
  • BlackBerry is running the 2016-09-06 for Priv and DTEK50.
  • Yeah that's what my wife got this morning on her Priv and I'll spend the next few weeks waiting for the update for the nexus 6p... Same story every month. My Nexus phone spends more time being exploitable than it does being patched because Google likes to roll out security updates over several weeks and I always seem to fall in the last group of the several weeks. If blackberry can do it, why not Google? I bought this phone directly from Google.
  • Ehhhhhhhhhhhhhhhhhhhhhhhhhhhhh.... Wellllllllllllllllllll OK fine -how thatguy97 feels about this
  • How do you know when you get the OTA update? I enrolled in the beta program, but I stayed in. I don't know if it's going to notify me or if it will just download itself or something. ((is confused))
  • You should have gotten the notification right away. Settings \ About Phone \ Software Update to check manually
  • I did that. I mean I'm wondering if I have the full Nougat or if I'm still just in the beta. I've seen people that haven't enrolled in the beta say they didn't get Nougat on their 6P's, so I guess the full version is not on mine yet.
  • It's likely that they don't actually know the difference. NRD90M is the build number for the final release. If you have anything before that (likely NPD90G or similar) you are on the beta. You should also have a tile in the quick settings that says the beta program and the build number.
  • I'm on NRD90M. Are you sure that's final version?
  • the R in the build number stands for Release that's the final live build of nougat 7.0 if you see a P in the build number it stands for Preview
  • I'm still on the June 1st security patch, so quit your whining.
  • Hahahahaha
  • It's a big old "Nope not yet," for my Nexus 5X on Nougat or security update.
  • Yep, got the update on my Priv yesterday in HK.
  • Odd because the OnePlus One on COS has been getting the patches on a regular basis. Gotten all of the security patches so far on 9-01
  • I'm confused...I am enrolled in the Nougat preview but haven't gotten an update on my N6 since July...there are updates but only for 6.0.1...
  • Let's not forget that the Nexus 5 is being dropped next month, leaving four Nexus devices that actually get security updates. Google makes them for manufacturers to apply to older devices (hahaha) but Google doesn't even do this themselves.
  • Still waiting on reports to see if perhaps this time Samsung fixed the problem created by Google that prevents third parties double tap to sleep (namely Nova's) to work with fingerprint unlocking.
  • Russel, in your opinion, Is there something we buyers can actually do to try to force manufacturers to release these patches? I have a HTC one m8 which still has the 12-2015 security patch, which is very disappointing. It's been 9 months! Cheers
  • Buy a phone from a manufacturer that pushes the updates in a timely manner. I know that doesn't help your present situation, but the only thing that will make OEM's care is if people don't buy their phones.
  • The phone had timely updates until it stopped since 2 more flagships were launched, the m9 and the 10. I understand why they can't support updates for more than 2 years (more or less, to be honest) but security updates should be launched after that time frame.
  • Hey there .. I'm running Nougat on Nexus 5x .. I downloaded Nougat via Beta Program .. will I get this update and security patch too for September