On September 30, Russian cybersecurity company Positive Technologies said it uncovered 11 mobile security vulnerabilities affecting Apple and Android devices, including Pixel phones, after researchers found weaknesses enabling unauthorized apps, network changes, higher access rights, and exposure of protected information.
The findings, shared with Russian news agency TASS, show how weaknesses inside everyday smartphone features can create wider security risks. Nine flaws affected Apple products, while two affected Android devices.
Both companies have released fixes, but unsupported devices may remain exposed.
Android Flaws Show How Little Interaction an Attack May Need
One of the reported Android security flaws involved a specially prepared Near Field Communication (NFC) tag. According to the researchers, simply holding a vulnerable smartphone close to the tag could cause it to download, install, and run an application without the owner approving each action.
The NFC security vulnerability is particularly important because it is built around quick physical interactions. The technology is used for contactless payments, digital tickets, device pairing, and smart tags, meaning users regularly place their phones close to NFC-enabled objects without expecting a security threat.
The second Android weakness involved an application already installed on the phone. It could reportedly change network settings without receiving additional permissions, including connecting the device to a Wi-Fi network selected by an attacker.
Researchers said the application could also add a certificate or modify proxy settings without requiring confirmation from the phone owner. These mobile security vulnerabilities show how an application that reaches a device may gain influence over how that device communicates with outside networks.
Google addressed both Android security flaws through patches issued in September 2026. Users should check whether the latest Android security update has reached their device, particularly because the report did not specify every Android version or Pixel model that was affected.
Keeping software patched remains an important part of mobile device security, especially when attacks can take advantage of weaknesses that require very little action from the user.
Apple Findings Revive Questions Around Security Research
The nine reported Apple security vulnerabilities covered several parts of Apple’s software environment, including system privileges, privacy protections, memory, and access to protected information.
One macOS flaw could reportedly allow a malicious application to gain the highest level of control over the computer. Another could expose information that the operating system would normally protect. Access keys could also be deleted without approval from the user.
A separate weakness was discovered inside the operating system kernel. Researchers said it could cause a device to fail or corrupt information stored in memory. Together, the findings show that mobile security vulnerabilities can reach deep into the operating system rather than only affecting individual applications.
Apple has released patches addressing the problems, although it did not publicly identify every operating system version carrying the fixes. That leaves users of older devices facing greater uncertainty when their hardware is no longer eligible for software support.
The disclosure also comes against a wider political and security backdrop surrounding Russian security researchers. Kaspersky previously said Apple refused to issue it a bug bounty after the company disclosed four iPhone zero-day vulnerabilities connected to the Operation Triangulation spying campaign.
Kaspersky researchers described the operation as “definitely the most sophisticated attack chain we have ever seen.”
Researchers also said they could not determine how attackers discovered an unusual hardware feature used during the campaign.
“We do not know how the attackers learned to use this unknown hardware feature or what its original purpose was. Neither do we know if it was developed by Apple or if it’s a third-party component,” said Kaspersky.
Apple previously rejected Russian allegations that it had cooperated with a government to create hidden access to its products.
“We have never worked with any government to insert a backdoor into any Apple product and never will,” stated Apple.
History adds another layer to the latest Apple security vulnerabilities, showing how vulnerability research can become tied to political tensions even when the technical weaknesses themselves require attention.
For users, the latest mobile security vulnerabilities reinforce a basic security lesson: installing vendor patches remains one of the strongest protections against known flaws. Maintaining good mobile device security becomes harder when older phones and computers stop receiving those updates altogether.
The bigger concern is therefore not only whether Apple and Google can discover and patch mobile security vulnerabilities, but how long their devices remain protected once manufacturers decide that software support has reached its end.
Inside Telecom provides you with an extensive list of content covering all aspects of the tech industry. Keep an eye on our Tech sections to stay informed and up-to-date with our daily articles.
