The Bug Is on Every Android 17 Phone, but Not in the Source Code Anyone Can See

On October 12, a developer opened an issue about two standard C functions, wcscspn() and wcspbrk(), failing to work correctly on Android 17 builds from September 2026. These functions are not rare APIs; they scan wide strings for the first character that matches or doesn't match a set of characters. In Android builds from September 2026, issues arise when the search set has two or more characters, all below U+0100, such as plain ASCII or Latin-1 characters.

The bug causes these characters to be falsely identified as a match, leading to false stops in various applications. The source code for Android 17, published in June 2026, appears to be correct; however, the bug resides in optimized binaries shipped to production phones. The bug's root cause is an asymmetrical branch in the code, where the skip logic for characters not in the set was lost during optimization.

This explains why emoji characters, extended-Latin letters, and other non-ASCII characters trigger the bug while ASCII characters work correctly. The issue was reported early on, and Google's engineers responded quickly, acknowledging the bug and providing a fix. However, the problem arose from a mismatch between the public source code and the optimized binaries shipped to devices.

The Android development model, which publishes source code only twice a year, exacerbated the issue as the relevant changes had not been included in the public source by the time the bug was reported.