Google Releases Android 17 QPR1 Beta 4 With May 2026 Patch for 21 Pixel Devices

Q: With one major Wireless ADB flaw patched, does a hidden VPN bypass vulnerability still leave Android users exposed?

Yes. The Android 17 QPR1 Beta 4 update closes a serious Wireless ADB hole, but it does not, based on the information provided, resolve the separate concern that Wireless ADB traffic can bypass Always-On VPN and its kill switch. The patched flaw is significant: Google’s May 2026 security update fixes CVE-2026-0073, a trust failure in `adbd` that could let an attacker on the same network bypass Wireless ADB authentication and gain a shell without user interaction. That is a direct remote-compromise risk, and Beta 4 appears to address it on supported Pixel devices. The VPN issue is different. The available reporting describes it as an undocumented behavior in which Wireless ADB binds directly to the physical network interface instead of the VPN tunnel, potentially leaking traffic even when users expect all connections to be forced through the VPN. Nothing in Google’s Beta 4 release notes says that behavior was changed. The noted fix only says a regression preventing Wireless ADB and local-network apps from connecting was resolved. That means users may be safer from unauthorized Wireless ADB access after updating, but not necessarily protected from VPN-policy bypass if they use Wireless Debugging. For security-sensitive users, the practical advice remains to install the latest patch, keep Developer Options and Wireless Debugging off unless needed, and avoid assuming Always-On VPN fully covers ADB-over-Wi‑Fi traffic until Google explicitly documents and fixes that behavior.

3 articles · Updated · 9to5Google · Jun 10

Android 17 QPR1 Beta 4 is rolling out to Pixel phones, tablets and foldables, bundling the May 2026 security patch and the latest quarterly platform fixes.
Seven listed fixes target bugs affecting external-display mouse visibility, Settings crashes in Private Space, screenshot audio behavior, 5x video jitter, Back Tap on the lock screen, OpenGL ES performance and Wireless ADB connectivity.
Google made system images available for 21 supported Pixel devices plus the Android Emulator, while beta users can also install the release over the air through the Android Beta Program.
Bug reports can be filed through the Android Beta Feedback app or Google’s issue tracker, underscoring that the release remains a test build following Android 17 updates unveiled at I/O 2026.