Google published its Android Security Bulletin—November 2026 on November 2, and it is one of the heavier monthly updates of the year: 216 vulnerabilities in total, 23 of them rated Critical. The most serious is a flaw that needs no tap, no download and no permission from the person holding the phone. If your device runs Android 14, 15, 16 or 17 and has not yet received the November patch, it is exposed — and the fix depends on your phone maker, not on Google alone.
The bulletin is the monthly patch list Google publishes for the Android platform, and the November edition carries an unusually sharp headline: a critical remote code execution vulnerability in the Framework component that, in Google’s own words, needs no user interaction to exploit. That is the kind of bug security teams treat as a priority, because the victim does not have to do anything wrong.
What CVE-2026-58868 actually is
The flaw is tracked as CVE-2026-58868 and carries a CVSS score of 9.8 out of 10. It is a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp, part of Android’s Framework component. In plain terms, a specially crafted media payload can write past the end of a memory buffer while the phone is decoding it, and that out-of-bounds write can be steered into running an attacker’s code — with no additional privileges needed and no tap required from the user.
It affects Android 14, 15, 16 (including the 16-qpr2 quarterly release) and 17. Google fixed it at security patch level 2026-11-01, so any device showing that patch level or later is protected against this specific flaw. The catch is distribution: Google ships the fix, but each manufacturer and carrier decides when it reaches a given phone, and millions of devices will sit unpatched for weeks or months.
The companion flaw that can silence emergency calls
CVE-2026-58868 is not the only zero-interaction problem in the bulletin. CVE-2026-58882, rated 7.5, is a flaw in the decodeWapPdu function that handles WAP Push SMS messages. A malformed message can crash the phone process — and all it takes is the target’s phone number. The crash persists across reboots, which means a phone could be knocked offline and stay that way, including its ability to make emergency calls, until it is fixed.
Proof-of-concept code for this SMS flaw is already circulating publicly, and similar code for the FrameDecoder flaw has also appeared online (see Aviatrix’s analysis of CVE-2026-58868). That matters because the window between disclosure and active exploitation keeps getting shorter: once a working demonstration exists, adapting it into a real attack is a matter of time and motive, not of discovery.
Two more critical remote code execution flaws sit in the same bulletin — CVE-2026-58876 and CVE-2026-58936, both rated 9.8 and both in Android’s System component, also fixed at the 2026-11-01 patch level. The November update is not a single-bug story; it is a bundle of serious fixes that all land at once.
216 fixes, 23 critical: the November bulletin in numbers
The full bulletin lists 216 vulnerabilities: 23 rated Critical and 193 rated High, according to Rescana’s breakdown of the November bulletin. Google defines two patch levels for the month. The 2026-11-01 level covers the Framework and System fixes, including the flaws above. The 2026-11-05 level adds the rest — kernel fixes and chipset-level issues, including a critical MediaTek modem flaw (CVE-2026-20499) — and Google states that patch level 2026-11-05 or later addresses every issue in the bulletin.
That two-level split is worth understanding, because a phone can show the 2026-11-01 level and still be missing the kernel and modem fixes. If your device offers the 2026-11-05 level, take it.
No confirmed exploitation — yet
One piece of good news: Google has not reported active exploitation of these vulnerabilities, and as of a November 4 check, none of the 216 CVEs in the bulletin appeared in CISA’s Known Exploited Vulnerabilities catalog. This is a patch-first disclosure, not a damage report.
That is not a reason to wait. The November’s exploited-vulnerability wave showed what happens when fixes sit uninstalled: a Zyxel switch zero-day, a WordPress Core flaw and an Apple WebKit bug all landed on CISA’s exploited list in the same week, and the attackers did not need new zero-days — they used flaws whose patches were already available. The lesson of that week applies directly to this bulletin.
How to check your patch level and update
Checking takes less than a minute. On most Android phones, open Settings, then Security and privacy (or About phone, then Android version), and look for the Android security patch level or the security update date. If it reads 2026-11-01 or later, the FrameDecoder flaw is fixed; if it reads 2026-11-05 or later, the whole November bulletin is covered. If it shows October or earlier, check for an update manually rather than waiting for a notification: open the system update screen and tap to check.
Pixel phones get Google’s patches first, usually within days. Samsung, Xiaomi, Motorola and other manufacturers follow on their own schedules, and carrier-locked phones can lag further. Xiaomi’s HyperOS 4 rollout, which is bringing Android 17 to 82 devices through November and December, is a reminder of how staggered Android updates are — the same software has to be tuned for different chips, carriers and regions before it ships.
What to do if your phone will not get the patch
Not every Android phone will receive this update. Devices on Android 12 and 13 are not listed as affected by the FrameDecoder flaw, but they remain unpatched against the SMS denial-of-service vector, and older phones that have passed their manufacturer’s support window will get nothing at all. If your phone is out of support, the honest options are: move to a phone that still gets security updates, or accept the risk with your eyes open — keep the phone off untrusted networks where possible, avoid installing apps from outside the Play Store, and do not use it for banking or sensitive accounts.
For businesses, the bulletin is a fleet-management problem. Managed Android devices should be checked against the 2026-11-01 minimum patch level, and device-management policies should enforce it where the tooling allows. An unpatched phone that connects to company email and cloud apps is a trusted device with an unpatched hole in it.
The wider picture is worth a look, too. Google’s XCPE botnet takedown this month showed that Android’s risks are not only in the platform code — more than a million TV boxes arrived with a backdoor baked into their firmware. And on the hardware side, the Motorola Signature 27 ships with Android 17 and a promise of seven years of security updates, which is exactly the kind of long support window this bulletin shows the value of. A phone that keeps getting patches is a phone that keeps getting safer; a phone that stops getting them only gets older.
The November bulletin is a routine monthly update with an unusually serious headline. Check your patch level tonight. If the update is there, install it. If it is not there yet, check again in a few days — and remember that the patch only protects you once it is actually on the phone.
