November 5, 2026

Google has released its November Android security update, addressing 216 vulnerabilities across the mobile operating system, Linux kernel components and hardware technologies supplied by major chipset manufacturers. The bulletin includes 23 vulnerabilities rated Critical, covering potential remote code execution, privilege escalation and denial-of-service attacks.

The most severe issue, tracked as CVE-2026-58868, affects Android’s Framework component. Google says successful exploitation could allow remote code execution without requiring additional execution privileges or user interaction. Other critical flaws affect Android System, Bluetooth, protected Kernel-Based Virtual Machine (pKVM) components, MediaTek modem technology and a closed-source Qualcomm component.

Published on November 2, the bulletin divides the fixes between two security patch levels: November 1 and November 5. The first group addresses 119 vulnerabilities, while the second covers another 97. Devices with the November 5 patch level or later are covered by all the issues listed in the bulletin.

The release highlights the complexity of protecting Android devices, where operating-system software, hardware drivers and manufacturer-specific components must work together. However, not every listed vulnerability affects every smartphone, and the availability of fixes depends on each device manufacturer’s update process.

What Does Google’s November Android Security Update Include?

Google’s November bulletin documents 216 vulnerabilities, including 23 rated Critical. The remaining issues are primarily classified as High severity. The fixes cover several areas of the Android platform rather than a single application or service.

The first group, associated with the 2026-11-01 security patch level, addresses 119 vulnerabilities:

• Android Framework: 65 vulnerabilities.
• Android System: 53 vulnerabilities.
• Android Runtime: One vulnerability.

The second group, associated with the 2026-11-05 security patch level, addresses 97 additional vulnerabilities involving kernel components and technologies from Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm.

The 23 Critical issues are distributed across these groups. Eight appear in the first group, including one Framework vulnerability and seven System vulnerabilities. The remaining 15 involve kernel components, MediaTek modem technology and a Qualcomm closed-source component.

The figures demonstrate why Android security depends on more than Google’s own operating-system code. Modern smartphones combine platform software with hardware drivers, firmware and proprietary components supplied by different technology companies.

A weakness in any of these areas may create security exposure, depending on how the affected component is integrated into a particular device.

CVE-2026-58868: A Critical Framework Flaw

The most severe issue in the November release is CVE-2026-58868, a Critical vulnerability affecting Android’s Framework component.

Google states that successful exploitation could lead to remote code execution without additional execution privileges. User interaction is also not required.

Remote code execution is particularly concerning because it can allow an attacker to execute instructions on a targeted device rather than merely access information or cause an application to crash.

The absence of a user-interaction requirement makes the vulnerability more serious. Under the conditions described by Google, a victim would not necessarily need to open a suspicious application, approve a permission request or interact with a malicious link for exploitation to occur.

The official bulletin lists Android versions 14, 15, 16, 16 QPR2 and 17 among the affected AOSP versions for this issue.

The public vulnerability description provides a more specific technical detail: the flaw involves a possible out-of-bounds write caused by a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp. However, the public information does not explain a complete exploitation chain or how an attacker would reach the vulnerable code.

Google also clarifies that its Critical severity assessment assumes platform and service mitigations are disabled for development purposes or successfully bypassed. This qualification matters because the rating describes potential impact under the assessment conditions; it does not mean that every real-world attack would automatically defeat Android’s security protections.

The November Android security update includes the corrective patch for this Framework issue at the November 1 patch level.

Other Critical Vulnerabilities Affect Android System

CVE-2026-58868 is not the only serious issue addressed in the first patch group.

Google identifies two additional Critical remote code execution vulnerabilities in Android System:

• CVE-2026-58876: Remote code execution.
• CVE-2026-58936: Remote code execution.

The same component also contains Critical privilege-escalation and denial-of-service vulnerabilities.

The privilege-escalation issues include CVE-2026-55275, CVE-2026-55283 and CVE-2026-58984. The denial-of-service issues include CVE-2026-58814 and CVE-2026-58882.

These vulnerability types create different security risks. Remote code execution concerns an attacker’s ability to execute instructions on a device. Privilege escalation involves obtaining permissions beyond those already available, while denial of service can interfere with the normal operation or availability of a system.

CVE-2026-58882 deserves particular attention because it affects Android’s handling of WAP Push messages. The Hacker News reported that a researcher had separately published research describing a serious crash involving a related function. However, neither Google’s bulletin nor the CVE record establishes that the reported research vulnerability and CVE-2026-58882 are the same issue. They should not be treated as confirmed identical without further technical evidence.

The November bulletin also lists a High-severity information-disclosure vulnerability in Android Runtime, alongside numerous other High-severity issues affecting Framework and System components.

Bluetooth, Kernel and Hardware Components Receive Critical Fixes

The second patch group extends beyond Android’s main operating-system components.

Google identifies six Critical vulnerabilities in kernel components, including issues affecting Bluetooth, pKVM and Human Interface Device functionality.

Bluetooth supports wireless communication with accessories and other devices. HID components handle interactions with input hardware, while pKVM is part of Android’s protected virtualization technology.

Some of the kernel vulnerabilities involve elevation of privilege. Google says the most severe issue in this group could allow remote privilege escalation without additional execution privileges or user interaction.

The bulletin also identifies eight Critical vulnerabilities in MediaTek modem components. Modems handle important cellular communication functions and interact with mobile networks. Security weaknesses in modem-related software can therefore be important, although the exact impact depends on the individual vulnerability and device configuration.

Qualcomm is also represented in the release. Google lists CVE-2026-25285 as a Critical vulnerability in a closed-source Qualcomm component.

The public Android bulletin does not provide detailed technical descriptions for every partner-supplied vulnerability. It directs readers to the relevant hardware manufacturers for further information and notes that severity assessments for those components are provided by the respective vendors.

This means users and security teams should avoid assuming that every hardware-related issue has identical attack conditions or consequences.

Why Google Uses Two Security Patch Levels

One important feature of the November release is its use of two security patch levels.

Google identifies November 1 and November 5 as the relevant dates. The arrangement gives Android manufacturers flexibility to distribute a common group of fixes sooner instead of waiting until every hardware-specific patch is ready.

Devices reporting security patch level 2026-11-01 or later include the vulnerabilities associated with the first group, along with fixes from previous bulletins.

Devices reporting security patch level 2026-11-05 or later must include all applicable fixes in both November groups and earlier bulletins.

This approach is particularly relevant to Android because the operating system runs on smartphones and tablets made by many companies. Google develops the Android platform, but manufacturers also integrate device-specific software, hardware drivers, modem firmware and proprietary components.

A manufacturer may therefore be able to distribute the common Framework and System fixes before completing testing for a particular chipset or device model.

Google says Android partners are encouraged to fix all issues in the bulletin and use the latest security patch level. The November Android security update should consequently be evaluated by the patch level installed on a device, not simply by the date a manufacturer announces a software release.

Which Android Devices Are Affected?

The November bulletin covers vulnerabilities associated with the Android versions and hardware components listed in Google’s technical tables.

For the Framework and System issues, the affected AOSP version information includes Android 14, 15, 16, 16 QPR2 and 17, although individual vulnerabilities may apply to different subsets of these versions.

The second patch group includes components from several hardware vendors. Whether a particular smartphone is affected depends on its chipset and the other components used in that model.

Google’s bulletin is not a complete device-by-device list of every affected smartphone. It provides vulnerability information that manufacturers use when preparing updates for their own products.

Owners of devices from Samsung, Xiaomi, OnePlus, Motorola, Google Pixel and other Android manufacturers should consult their respective update notices rather than assume that all models receive the same release simultaneously.

Older devices require particular attention. If a manufacturer no longer supports a model, it may not receive the latest security fixes. The bulletin does not guarantee that every Android phone running an affected version will receive an update.

How Android Users Can Check Their Security Patch Level

Android users can check the installed security patch level directly through their device settings. The exact menu names may differ between manufacturers, but the general process is:

1. Open the phone’s Settings application.
2. Select About phone or About device.
3. Open Android version or the relevant software information page.
4. Locate the Android security update date.
5. Check whether the device has received the November 2026 security patch.

Users should distinguish the Android security update date from the Google Play system update date. These represent different update mechanisms and do not necessarily indicate that every vulnerability in the monthly bulletin has been fixed.

For this release, the important patch levels are:

Security patch level	Coverage
2026-11-01	Fixes associated with the first November patch group
2026-11-05 or later	All vulnerabilities covered by the November bulletin

Google Pixel users can check for available updates through Settings, System and Software update. Owners of other Android devices should follow their manufacturer’s instructions and check whether an update is available for their specific model and region.

Google’s support documentation explains how to check and install Android version updates. If the November patch has not appeared, users should periodically check their device’s update settings and consult the manufacturer’s official support information.

Why Android Updates May Arrive at Different Times

Security updates do not reach every Android smartphone simultaneously.

Google publishes the security bulletin and provides the underlying fixes, but manufacturers must integrate applicable changes into their own software releases. That process can involve device-specific testing, compatibility checks, carrier approval and regional distribution arrangements.

An update may therefore become available on one model while another device from the same manufacturer continues to use an earlier patch level.

The situation can also differ between markets. Devices sold through different carriers or regional distribution channels may receive updates on different schedules.

Google’s Pixel support information explains that updates are rolled out gradually and can take time to reach every eligible device. Owners of non-Pixel phones are directed to their manufacturers or carriers for update information.

For organisations managing large numbers of Android devices, this creates an additional security-management challenge. IT teams should maintain an inventory of supported devices, monitor manufacturer advisories and establish policies for devices that cannot receive critical updates.

Publishing a patch is only one part of the process. Protection depends on whether the manufacturer delivers the fix and whether users install it.

What Should Users and Organisations Do Now?

The most practical response is to install the latest security update made available for each supported device.

Users should also take several additional precautions:

• Check manufacturer updates: Review the official support page or update settings for the specific device model.
• Install available security patches: Do not postpone a relevant security update without a good reason.
• Keep applications updated: Update applications through trusted distribution channels, including Google Play where available.
• Use Google Play Protect: Keep the built-in protection enabled and review warnings about potentially harmful applications.
• Avoid unsupported software: Consider replacing devices that no longer receive security updates, particularly when used for sensitive work.
• Monitor organisational devices: Businesses should track security patch levels and identify devices that remain unpatched.
• Use trusted applications: Avoid installing software from unfamiliar websites or unverified sources.

The Android security update is especially important for organisations whose employees use mobile devices for business communications, authentication, financial access or sensitive corporate information.

Businesses should prioritise devices based on their role, exposure and support status. Mobile-device management systems can help IT teams identify devices running older security patch levels and follow up with users or manufacturers.

Users should also remember that a recent application update does not necessarily mean the operating system has received its latest security fixes. The Android security patch level is the more relevant indicator for the vulnerabilities documented in Google’s monthly bulletin.

The Importance of Timely Android Security Updates

Google’s November release demonstrates the scale and complexity of maintaining security across a widely deployed mobile operating system.

The 216 vulnerabilities span Android Framework, System, Runtime, kernel components and hardware technologies from multiple suppliers. The 23 Critical issues include remote code execution, privilege escalation and denial-of-service weaknesses that could have serious consequences if successfully exploited.

However, the public information available as of November 5 does not establish that the vulnerabilities in this monthly bulletin are being actively exploited in attacks. Their security significance comes from their potential impact and the need to install the fixes, not from an unsupported claim of a confirmed attack campaign.

The two patch levels also show why users need to check the actual update installed on their devices. Receiving an update notification and having all applicable November fixes are not necessarily the same thing.

For Android users, the immediate priority is straightforward: check the security patch level, install available updates and follow the manufacturer’s guidance. For manufacturers and enterprise administrators, the challenge is ensuring that critical fixes reach supported devices quickly and that unsupported products do not remain exposed indefinitely.

Source note: This report draws on Google’s Android Security Bulletin for November 2026, reporting from SecurityWeek and The Hacker News, and official Android support documentation. Vulnerability severity and affected-version information are attributed to Google’s bulletin and relevant hardware vendors. The absence of confirmed exploitation is stated according to information available as of November 5, 2026.

NewsFlayer — Your trusted source for cybersecurity news, digital threats and technology developments.