Google's November Android Update Fixes 216 Flaws, Including a Critical Remote Code Bug That Needs No User Action

Google's November 2026 Android security bulletin, published Nov. 2, lists 216 vulnerabilities. Twenty-three are rated Critical and 193 High. The prior month's bulletin covered 25 flaws.

The most severe is CVE-2026-58868, a flaw in the Android Framework. Google says it could allow remote code execution with no additional privileges and no user interaction. It affects Android 14 through 17.

The bug is a possible out-of-bounds write caused by a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp. Neither the bulletin nor the CVE record says how an attacker would reach that code.

Two more remote code flaws, one SMS bug

Two other Critical remote code execution flaws sit in the System component: CVE-2026-58876 and CVE-2026-58936. Both apply to every listed Android version, and none requires user interaction, according to the bulletin.

A separate Critical flaw, CVE-2026-58882, could allow a remote denial-of-service attack with no user interaction. Its CVE record places it in decodeWapPdu, a function handling WAP Push messages that arrive by SMS.

On Oct. 29, a researcher publishing as Mark B posted a write-up titled "SMS of Death" about a bug in the same function. The researcher says one malformed WAP Push message crashes com.android.phone and ends any active call, emergency calls included. The message never appears in the inbox, and the phone retries it at each startup. A proof-of-concept app is public.

The bulletin and the CVE record do not say whether CVE-2026-58882 is the bug in that write-up. Techlicious reported that Google's November bulletin now addresses the "SMS of Death" flaw, and noted the researcher first pointed to October's update as the fix. The researcher also says Android 12 and 13 are vulnerable. Google's bulletin lists fixes only for Android 14 through 17, and Google's records do not say whether older versions contain the flaw.

No attacks reported

As of Nov. 4, Google's bulletin did not report exploitation of any of the flaws. None appeared in the Known Exploited Vulnerabilities catalog kept by the U.S. Cybersecurity and Infrastructure Security Agency as of its Nov. 3 update. Security firm Rescana noted that CISA's entries on the National Vulnerability Database records for the three Critical remote code execution bugs say "Exploitation: none."

Google's own caveat matters here. Its Critical rating assumes the protections built into Android and Google's services are turned off or bypassed. Rescana, which rates the advisory High rather than Critical, argues that point cuts against panic. Its reasoning: nobody has reported exploitation, and platform mitigations still stand between a bug and a working attack. It still calls a no-interaction remote code flaw serious enough to plan around now.

Two patch levels

Google splits the bulletin into two security patch levels so manufacturers can ship common fixes sooner.

• 2026-11-01 covers the Framework, System and Android runtime components. That includes CVE-2026-58868. BigGo Finance counts 119 fixes at this level, eight of them Critical.
• 2026-11-05 adds kernel and vendor code from Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm, and covers the full bulletin. It brings 97 more fixes.

The second level carries eight Critical MediaTek modem issues, six Critical Linux kernel issues and one Critical Qualcomm closed-source issue. Two of the kernel entries are Bluetooth privilege-escalation bugs, according to Heise.

Google says it encourages manufacturers to include every fix in the bulletin. It also says it notified Android partners of all issues at least a month before publication. It said it would publish source code patches to the Android Open Source Project within 48 hours of the bulletin's release.

Phones on Android 10 or later may also get some fixes through Google Play system updates. CVE-2026-58876 is on that list. CVE-2026-58868 is not, so the Android security update date is the one to check for it.

The bulletin offers no workaround for phones that cannot install the update yet.

The delivery gap

Google writes the patch. Phone makers and carriers decide when it reaches a handset.

Samsung published its November bulletin on Nov. 3. It lists 20 critical Google fixes and 24 Samsung-specific issues, including the three remote code flaws and the SMS bug. Samsung says availability varies by model and region, and some chipset fixes may arrive in later updates.

Techlicious' reviewer said his Pixel 10 Pro XL still showed an Oct. 5 patch level on Nov. 3.

To check a phone, find the Android security update date, usually under Settings, then Security & privacy, then System & updates. Menu names vary by maker. A date of 2026-11-01 or later covers CVE-2026-58868. A date of 2026-11-05 or later covers everything in the bulletin.

Owners of phones on Android 12 or 13 that no longer receive security updates have no patch coming from Google's bulletin. Techlicious advised them to consider replacing the device.

The open question is timing. Manufacturers have not said when most devices will reach 2026-11-05, and the researcher's public proof-of-concept for the SMS bug already exists.