Google’s November 2026 Android Security Bulletin lists a Critical remote code execution flaw in the Android Framework that needs no extra privileges and no user interaction. Patches ship at two levels, 2026-11-01 and 2026-11-05, so check which one your phone actually shows before you relax.
The bulletin went up on November 2, 2026, and by my count of its tables it covers 216 CVEs. Most people will never see the bug being exploited. The practical question is how soon your phone gets the fix.
TL;DR: Google’s November bulletin fixes 23 Critical and 193 High severity issues across two patch levels. The headline bug is a Framework remote code execution flaw, CVE-2026-58868, that needs no user interaction. The bulletin does not say any issue is exploited in the wild. Install the update as soon as your maker ships it, and aim for patch level 2026-11-05.
What the Android November security patch fixes
The bulletin’s most severe entry is CVE-2026-58868, a Framework bug tracked as A-486464711. Google describes it as a critical vulnerability that allows remote code execution without extra execution privileges or user interaction.
It affects Android 14, 15, 16, 16-qpr2 and 17, according to the bulletin. Two more Critical remote code execution bugs, CVE-2026-58876 and CVE-2026-58936, sit in the System component and also cover every listed version.
The bulletin does not say whether any of these are being exploited. That silence is not a clean bill of health, but it is also not an alarm. The split between the two patch levels shapes how quickly you will see protection.
| Section | Critical | High |
|---|---|---|
| Framework and System (2026-11-01) | 8 | 111 |
| Kernel, MediaTek, Qualcomm and other vendors (2026-11-05) | 15 | 82 |
| Total | 23 | 193 |
Why two patch levels matter for your phone
The 2026-11-01 level covers the Android runtime, Framework and System components. The 2026-11-05 level includes everything in the first level plus kernel and vendor fixes, so it is the one to look for.
The kernel section carries six Critical entries. They include two pKVM elevation of privilege bugs, CVE-2026-59044 and CVE-2026-59045, two Bluetooth bugs, CVE-2026-53256 and CVE-2026-89774, and an HID bug, CVE-2026-80604. Google says the kernel’s most severe issues are remotely exploitable without extra privileges or user interaction.
If your phone stops at 2026-11-01 for a few weeks, you have the Framework fix but not the chip and kernel fixes. That gap is common, and it is the detail that usually goes unnoticed in monthly patch coverage.
Vendor chip bugs that Google only lists
MediaTek accounts for eight Critical Modem issues, from CVE-2026-20499 through CVE-2026-20549, with severity rated by MediaTek. Qualcomm has one Critical closed-source entry, CVE-2026-25285.
Google also lists High severity fixes from Arm, Imagination Technologies, Unisoc and Qualcomm. These depend on your phone’s chipset, so two people on the same Android version can face different exposure.
The fixes for those parts reach you through your phone maker, not Google directly. That is why a Pixel and a mid-range phone from a smaller brand can sit weeks apart on the same bulletin.
How to check your Android security patch level
On most phones the patch level sits under Settings, About phone, then Android version, though the menu path varies by maker. If it shows November 1, 2026 or later, the Framework and System fixes are in. If it shows November 5, 2026 or later, everything in this bulletin is covered.
Some fixes also arrive through Google Play system updates on Android 10 and later, so a patch date can move without a full system update. Google says it notifies Android partners of all issues at least a month before publication, which is why some makers ship quickly.
Google Play Protect is on by default on phones with Google Mobile Services. The bulletin says it helps most with apps installed from outside Google Play, but it is a mitigation, not a replacement for the patch. Our Android update tracker follows the patch dates as they roll out.
What to do while you wait for the update
Install the update the day it appears. Keep automatic updates on, and avoid sideloading apps until your patch date moves to November.
Check Settings again in a week if nothing has arrived. I would not expect a Pixel or a recent Galaxy flagship to lag long, and I would not be surprised if budget phones took a month or more.
Older phones that no longer get updates are the real concern. A bulletin like this is a reminder that the support window, not the spec sheet, decides how safe a phone stays.
