Behind the usual updates of smartphones and computers, there are often fixes to quite specific scenarios of the attack: Positive Technologies specialists helped Google and Apple close 11 vulnerabilities in Android, Google Pixel smartphones and the Apple ecosystem. Two problems in Android received a high degree of danger and entered the September security updates.
Android found vulnerabilities CVE-2026-57012 and CVE-2026-28616. The first affected Google Pixel and under certain conditions allowed through a specially prepared NFC tag to download, install and launch the application without confirming the owner. The second gave the already installed application the ability to change network parameters without additional permissions and user participation.
In particular, the application could connect the smartphone to a given Wi-Fi network, set the certificate and change the connection parameters, including the proxy. Both problems were discovered by PT Maze specialist Alyona Sklyarova. Such a scenario did not require additional permissions from the already installed application. Google has closed both vulnerabilities in September security updates.
Another eight vulnerabilities PT Maze specialist Ilya Andr found in the Apple ecosystem. The most notable, CVE-2026-43783, affected macOS and could allow the malicious application to get maximum privileges in the system. Other errors opened applications access to secure data, and in one scenario allowed you to delete access keys without user confirmation.
Separate vulnerability CVE-2026-65330 was in the core of Apple's operating systems. The specialist of PT ESC Mikhail Lozhnikov participated in its discovery. Under certain conditions, the error could cause the device to fail or damage the memory of the kernel. Earlier, in 2025-2026, specialists from Positive Technologies also found problems in the system components of Apple and the Shortcuts app.
Positive Technologies recommends installing current security updates on Android, Apple devices, and Mac computers. Users are also advised to enable automatic installation of updates and check if the manufacturer supports the installed version of the system. Current versions close already known vulnerabilities and reduce the risk of their exploitation.
Android found vulnerabilities CVE-2026-57012 and CVE-2026-28616. The first affected Google Pixel and under certain conditions allowed through a specially prepared NFC tag to download, install and launch the application without confirming the owner. The second gave the already installed application the ability to change network parameters without additional permissions and user participation.
In particular, the application could connect the smartphone to a given Wi-Fi network, set the certificate and change the connection parameters, including the proxy. Both problems were discovered by PT Maze specialist Alyona Sklyarova. Such a scenario did not require additional permissions from the already installed application. Google has closed both vulnerabilities in September security updates.
Another eight vulnerabilities PT Maze specialist Ilya Andr found in the Apple ecosystem. The most notable, CVE-2026-43783, affected macOS and could allow the malicious application to get maximum privileges in the system. Other errors opened applications access to secure data, and in one scenario allowed you to delete access keys without user confirmation.
Separate vulnerability CVE-2026-65330 was in the core of Apple's operating systems. The specialist of PT ESC Mikhail Lozhnikov participated in its discovery. Under certain conditions, the error could cause the device to fail or damage the memory of the kernel. Earlier, in 2025-2026, specialists from Positive Technologies also found problems in the system components of Apple and the Shortcuts app.
Positive Technologies recommends installing current security updates on Android, Apple devices, and Mac computers. Users are also advised to enable automatic installation of updates and check if the manufacturer supports the installed version of the system. Current versions close already known vulnerabilities and reduce the risk of their exploitation.
