Google published the Android Security Bulletin for November 2026 on 2 November, and it is one of the larger ones in recent memory: 216 vulnerabilities by eSecurity Planet's count, roughly two dozen of them rated critical. The split across two patch levels is part of the story.
The first batch, patch level 2026-11-01, fixes 119 issues across Framework, System and Runtime — 65 in Framework, 53 in System, one in Android Runtime. The second, patch level 2026-11-05, covers a further 97 in the Linux kernel and in components from Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm. Devices at 2026-11-05 or later carry every fix in the bulletin; 2026-11-01 covers only the first half plus earlier bulletins.
The one that matters: CVE-2026-58868
The worst of them is in Framework: CVE-2026-58868, Android bug A-486464711. Google's wording is the standard but still remarkable one — a critical vulnerability that could lead to remote code execution with no additional execution privileges needed, and "user interaction is not needed for exploitation." It affects Android 14, 15, 16, 16-qpr2 and 17.
A technical write-up by Aviatrix places the cause in a heap buffer overflow in the `onOutputReceived` function of `FrameDecoder.cpp` — that is, in the handling of incoming frames rather than in any app a person would have to open. That analysis lists no public exploit; the critical rating reflects potential impact rather than observed abuse.
Two more critical remote-code-execution flaws sit in the System component: CVE-2026-58876 and CVE-2026-58936. Beyond those, the bulletin carries critical privilege escalations in System (CVE-2026-55275, CVE-2026-55283, CVE-2026-58984), in the kernel's protected virtual machine layer — pKVM, CVE-2026-59044 and CVE-2026-59045 —, in Bluetooth (CVE-2026-53256, CVE-2026-89774) and in HID handling (CVE-2026-80604). The chipset sections carry their own criticals: seven MediaTek modem flaws, including CVE-2026-20499 and CVE-2026-20545 through CVE-2026-20549, and Qualcomm's closed-source component CVE-2026-25285.
The 'SMS of Death' returns to the bulletin
Worth singling out is CVE-2026-58882, a critical denial-of-service flaw nicknamed the "SMS of Death." It lives in WAP Push SMS handling — specifically `decodeWapPdu` — and can crash the telephony process using only the target's phone number, no interaction, cutting into active calls including emergency ones and persisting across reboots. Independent researcher Mark Blaszczyk disclosed it publicly on 29 October after reporting it to Google in May, and a proof of concept is circulating. Google had indicated an October fix, yet the flaw still appears in November's bulletin; that does not prove previously patched devices stayed exposed, but it does mean patch level is worth checking rather than assuming.
Aviatrix also argues that devices on Android 12 and 13 contain the same vulnerable code but fall outside the supported window, leaving them without a vendor patch. That is a third-party assessment rather than part of Google's bulletin, but it matches the structural problem the rest of the month illustrates.
Samsung ships its own bundle; everyone else takes their time
Samsung has published its own November package of 206 fixes, per reporting via SammyGuru: 178 Android fixes from Google, four semiconductor fixes and 24 of its own, spanning the bootloader, camera filter plugins, Contacts, Dialer, Messages and SIM lock. There is no firm rollout schedule; availability depends on model, carrier and region.
That gap is the real risk. Patch availability is not patch installation. Between Google's publication and an update landing on a given handset there are often weeks or months, and for a critical flaw that needs no user interaction, that window is the attack surface. For fleets, the practical response is to check patch level rather than update date, prioritise devices with access to mail and corporate applications, and set a minimum patch level in MDM policy where the tooling allows it.
On the device itself the test is simple: `ro.build.version.security_patch` should read 2026-11-01 or later, ideally 2026-11-05. On Pixel that is Settings → System → System update; on Samsung, Settings → Software update → Download and install. If the value cannot be found, or the handset no longer receives updates, that is worth weighing before the next zero-interaction critical arrives.
