Critical Android Flaw Allows Zero-Interaction Denial-of-Service Attacks

Google's April 2026 Android Security Bulletin fixes a critical zero-click Framework denial-of-service vulnerability (CVE-2026-0049) that can crash devices without user interaction and a high-severity StrongBox hardware keystore vulnerability (CVE-2025-48651) affecting multiple vendors (Google, NXP, STMicroelectronics, Thales); users are advised to apply the 2026-04-05 patch level (with 2026-04-01 addressing the Framework issue) to mitigate these risks.