Last updated: November 6, 2026. Security bulletins are revised after publication and phone makers ship updates on their own schedules, so confirm details in Google’s Android Security Bulletin and in your phone’s Settings. This guide is informational and is not affiliated with Google or any phone maker. Counts below come from news coverage of the bulletin, which differs slightly between outlets.
Google’s November 2026 Android security update fixes more than 200 vulnerabilities, including a critical flaw that could allow remote code execution without any action from the user. To be covered by the fixes for that flaw, your phone needs a security patch level of 2026-11-01 or later. To be covered by everything in the bulletin, you need 2026-11-05 or later. Here is what changed, who is affected and how to check your own phone in under a minute.
The Short Answer
- What happened: Google published the November 2026 Android Security Bulletin on November 2, 2026, with fixes split across two patch levels, 2026-11-01 and 2026-11-05.
- How big is it: SecurityWeek reports over 200 vulnerabilities, and The Hacker News counts 216, of which 23 are rated Critical.
- Is it being exploited? As of November 4, The Hacker News reported that Google’s bulletin did not mention attacks exploiting these flaws, and none were in CISA’s Known Exploited Vulnerabilities catalog as of its November 3 update. That can change, so do not treat it as a reason to wait.
- What to do: open Settings, check your Android security update date, and install any update your phone offers.
How to Check Your Android Security Patch Level
- Open Settings and tap About phone (or About tablet).
- Tap Android version. Menu names vary a little by manufacturer.
- Find Android security update and read the date. Also look for Google Play system update.
- If the security update date is 2026-11-01 or later, you have the Framework and System fixes. If it is 2026-11-05 or later, you have the full bulletin, including kernel and chip-vendor fixes.
- If the date is older, go to Settings > System > System update (or Software update on some phones) and check for an update.
Google’s own help page, “Check & update your Android version,” explains these steps for Pixel and other Android phones.
| Patch level | What it covers |
|---|---|
| 2026-11-01 | Framework, System and Android runtime fixes, including CVE-2026-58868 and the SMS fix CVE-2026-58882 |
| 2026-11-05 | Everything in the bulletin, adding kernel and chip-vendor components such as Arm, MediaTek, Qualcomm and Unisoc |
The Most Serious Fixes
CVE-2026-58868: critical Framework flaw
The headline issue is a critical vulnerability in Android’s Framework. According to The Hacker News, it is a heap buffer overflow in a media frame decoder that could allow remote code execution with no user interaction and no extra execution privileges. It is listed as affecting Android 14 through 17 and is fixed at patch level 2026-11-01 or later. The Hacker News notes that, unlike some other flaws in the bulletin, it is not delivered through Google Play system updates, so it needs a full system update from your phone maker.
CVE-2026-58882: the “SMS of Death” bug
A second critical issue is a remote denial-of-service flaw in the phone’s handling of WAP Push messages sent by SMS. CyberInsider reports that a crafted message could crash the phone process and end active calls, including emergency calls, and that a public proof-of-concept exists. The researcher disclosed it on October 29. The Hacker News adds that Android 12 and 13 run the same code but are not receiving a fix, which is one more reason to move off versions that no longer get security updates.
Other critical fixes
Coverage of the bulletin also lists additional critical remote code execution flaws in the System component (CVE-2026-58876 and CVE-2026-58936), critical kernel flaws affecting components such as Bluetooth and HID, and critical modem and closed-source component flaws from chip vendors, including MediaTek and Qualcomm. Google also resolved 17 flaws early through Google Play system updates, according to SecurityWeek. Wear OS and Android XR received separate bulletins with high-severity fixes.
When Will My Phone Get It?
Google publishes the bulletin, but phone makers and carriers decide when to ship the update to each model. Pixel phones are usually first. Other brands can take days or weeks, and older or budget models may not receive it at all. Neither Google’s bulletin nor the coverage reviewed for this article gave model-by-model dates, so the best source is your manufacturer’s own update page or your phone’s System update screen.
What If Your Phone Can’t Update?
The bulletin offers no workaround for devices that cannot receive the patch yet. Practical steps that reduce your risk without relying on the fix:
- Keep automatic updates turned on, and install Google Play system updates when offered.
- Install apps only from Google Play and review the permissions an app asks for.
- Be careful with unexpected links and messages, even though the most serious flaws described here do not require you to tap anything.
- If your phone no longer receives security updates, plan to replace it. Our guide to knowing when to replace your phone battery can help you judge whether an older device is still worth keeping.
Using an iPhone or a Windows PC?
Apple users can read what recent updates fixed in our guides to the iOS 27.0.1 update and Apple’s September 2026 security update. Windows users who want to keep a PC protected after support ends can see how to enroll in Windows 10 Extended Security Updates. For stronger account protection on any phone, see how to switch from passwords to passkeys.
Frequently Asked Questions
What is the November 2026 Android security patch level?
There are two: 2026-11-01 and 2026-11-05. A phone showing 2026-11-05 or later has all the fixes in the bulletin.
Which Android versions are affected by CVE-2026-58868?
Android 14 through 17 are listed as affected. Google does not say whether Android 12 and 13 contain the flaw.
Do I need to do anything if my phone updates automatically?
Check that the update actually installed by reading the Android security update date in Settings. Automatic updates can be delayed by your manufacturer or carrier.
Is the SMS bug something I can turn off?
The coverage reviewed here describes no setting that disables it. The fix is the security update.
Bottom Line
Open Settings, read your Android security update date, and install the November update as soon as your phone offers it. If your date shows 2026-11-01 or later you are covered against the most serious Framework flaw, and 2026-11-05 or later covers the whole bulletin.
Sources: SecurityWeek, “Android’s November 2026 Updates Patch Over 200 Vulnerabilities”; The Hacker News, “Google Patches Critical Android Flaw That Could Allow RCE Without User Interaction”; CyberInsider, “Android November update fixes critical flaws and ‘SMS of Death’ bug”; Google, Android Security Bulletin and “Check & update your Android version” (support.google.com/android/answer/7680439). Google’s bulletin page could not be opened directly while this article was prepared, so counts and CVE details come from the news coverage above.
