September 2026 Security Updates: iPhone, Chrome, Windows -

Quick answer: If you use an iPhone, Chrome, Windows or Android, there are security fixes from September 2026 you should install now. Apple patched a flaw it says was exploited in targeted attacks (update to iOS 26.7.1 or iOS 27.0.1), Google fixed its seventh actively exploited Chrome zero-day of the year, and Microsoft’s September Patch Tuesday closed two Windows zero-days.

None of these bugs needs you to do anything clever. You don’t have to understand the technical details to stay safe; you just have to make sure the update has actually landed on your devices. Below is what was fixed, which version you should be on, and how to check in under a minute per device.

All dates and version numbers are as of 5 October 2026. If you’re reading this later, a newer version will also include these fixes, so “this version or later” is what matters.

iPhone and iPad: install iOS 26.7.1 or iOS 27.0.1

On 28 September 2026, Apple released iOS 26.7.1 and iPadOS 26.7.1 to fix a single bug, CVE-2026-86950, in CoreGraphics, the part of the system that draws images and documents. According to Apple, “processing a maliciously crafted file may lead to arbitrary code execution.” In plain terms, opening a booby-trapped file could let an attacker run their own code on your phone.

Apple says it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. The bug was reported by Meta’s product security team. That wording usually means spyware-style attacks on a small number of people, not a mass campaign, but the fix costs you nothing, so there’s no reason to wait.

The same day, Apple also shipped macOS Tahoe 26.7.1, macOS Sequoia 15.8.1 and iOS 27.0.1, according to its security releases page. Which one you need depends on what you’re running now:

Still on iOS 26: install iOS 26.7.1. It’s available for iPhone 11 and later.
Already on iOS 27: install iOS 27.0.1 or later. iOS 27 itself, released on 14 September 2026, included a long list of security fixes of its own.
Mac: install macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1 if you’re on one of those versions. If you’ve moved to the newest release, macOS Golden Gate 27, install 27.0.1.

How to update your iPhone

Open Settings and tap General.
Tap Software Update.
If you see iOS 26.7.1 or iOS 27.0.1 (or newer), tap Update Now and keep the phone charging and on Wi-Fi.
While you’re there, turn on Automatic Updates, including the option for security responses, so future fixes install on their own.

Chrome: the seventh exploited zero-day of 2026

On 9 September 2026, Google released a Chrome update for CVE-2026-87491, an out-of-bounds write bug in V8, the engine that runs JavaScript on websites. Google’s advisory said it “is aware that an exploit for CVE-2026-87491 exists in the wild,” as BleepingComputer reported. It was the seventh Chrome zero-day exploited in attacks this year.

The fixed versions are 153.0.8010.36 for Windows and Linux and 153.0.8010.37 for Mac. Google usually keeps the technical details private until most people have updated, which is another reason not to put this off.

How to update Chrome on a computer

Click the three-dot menu in the top-right corner.
Go to Help and then About Google Chrome.
Chrome checks for updates and downloads them. Click Relaunch when it appears.

Chrome updates itself in the background, but the fix only takes effect after the browser restarts. If you keep dozens of tabs open for weeks, that restart may never happen on its own. On Android, update Chrome from the Play Store. Other browsers built on the same Chromium code, such as Microsoft Edge and Brave, release their own updates, so check those too if you use them.

Windows: two zero-days in a record Patch Tuesday

Microsoft’s September 2026 Patch Tuesday arrived on 8 September and was its largest ever. BleepingComputer counted 966 vulnerabilities, including 105 rated Critical; other trackers, such as SecurityWeek, arrived at slightly higher totals depending on what they counted.

The two zero-days were both “elevation of privilege” bugs, which let an attacker who already has a foothold on a PC take full control of it:

CVE-2026-81963 in the Windows Update Stack.
CVE-2026-85880 in Windows ALPC, a component programs use to talk to each other.

Bugs like these are often chained with a malicious download or a browser flaw, which is why patching the browser and Windows together matters. Windows 10 PCs enrolled in Extended Security Updates received the fixes too, as update KB5122878.

How to check Windows Update

Open Settings and go to Windows Update (on Windows 10, it’s under Update & Security).
Click Check for updates and install everything listed.
Restart when asked. Many fixes don’t apply until you do.

Updates close the holes attackers use, but many real-world account takeovers still start with a stolen password. If you haven’t switched your main accounts to passkeys yet, our guide on how to set up passkeys takes about ten minutes.

Android: look for the 2026-09-05 patch level

Google’s Android Security Bulletin for September 2026, published on 8 September, describes its most severe issue as a critical flaw in the System component “that could lead to remote code execution with no additional execution privileges needed,” with no user interaction required. SecurityWeek counted about 180 vulnerabilities across the two patch levels. Unlike the Apple and Chrome bugs, the bulletin didn’t flag any of these as exploited in the wild.

Android updates reach phones at different speeds depending on the brand. Pixels usually get them first; Samsung, OnePlus, Xiaomi and others follow on their own schedules. To check yours:

Open Settings and search for Security update (or look under About phone or Security & privacy).
Check the Android security update date. A date of 5 September 2026 or later covers everything in this bulletin. The October bulletin hadn’t been published when we checked on 5 October 2026.
Also check Google Play system update, which installs separately.

If your phone shows a patch level many months old and no update is offered, the maker may have stopped supporting it. That’s a sign to plan a replacement, especially if you use it for banking or UPI.

Fake apps pushed through social media ads are a separate risk that no system update can fully fix. India’s cybercrime centre flagged one such campaign in August 2026; see what I4C warned about and how to protect yourself.

Quick checklist: what version should you be on?

Device or app	Install this version or later	Released
iPhone/iPad on iOS 26	iOS/iPadOS 26.7.1	28 Sep 2026
iPhone/iPad on iOS 27	iOS/iPadOS 27.0.1	28 Sep 2026
Mac	macOS Tahoe 26.7.1, Sequoia 15.8.1 or Golden Gate 27.0.1	28 Sep 2026
Chrome (Windows/Linux)	153.0.8010.36	9 Sep 2026
Chrome (Mac)	153.0.8010.37	9 Sep 2026
Windows 10/11	September 2026 cumulative update	8 Sep 2026
Android	Security patch level 2026-09-05	8 Sep 2026 (varies by brand)

Microsoft’s next Patch Tuesday falls on 13 October 2026, so expect another round of Windows updates then. For more practical guides like this, see our Cybersecurity and Privacy section.

Frequently asked questions

What is a zero-day vulnerability?

It’s a security flaw that attackers were using, or that was public, before the company had a fix ready. The name comes from the developer having “zero days” of warning. Once a patch ships, the risk drops only for people who install it.

I’m not a journalist or activist. Do I really need these updates?

Yes. Targeted bugs often get reused by other attackers once details leak, and every update also fixes many other flaws that weren’t exploited yet. Updating is the cheapest protection you have.

Is it safe to update my phone right away?

For security-only releases like iOS 26.7.1, waiting rarely helps. Back up first if you’re nervous, keep the phone charging, and install on a stable Wi-Fi connection.

My Android phone doesn’t show the September patch yet. What should I do?

Check again over the next few weeks, because brands roll out updates in stages. In the meantime, keep Chrome and your apps updated from the Play Store, avoid installing apps from links in messages, and keep Google Play Protect turned on.

September 2026 Security Updates: iPhone, Chrome, Windows