Android's November update fixes a zero-click Framework bug and 22 more critical flaws. Check for the 2026-11-05 patch

Google published its November 2026 Android Security Bulletin on November 2, and the headline item is a critical remote code execution bug in the Android Framework (CVE-2026-58868) that, according to Google, can be triggered with no user interaction. The bulletin covers Android 14, 15, 16, 16 QPR2 and 17.

Why it matters: "zero-click" bugs are the ones attackers prize most, because the victim doesn't have to tap a link or install anything. Google doesn't mark any November issue as under "limited, targeted exploitation" — the phrase it uses when it knows of attacks — and Daily CyberSecurity also reports no confirmed in-the-wild exploitation. That makes this a routine-but-important update rather than an emergency. The exception worth knowing about is a phone-crashing SMS bug with a public proof of concept (more below).

The numbers

Daily CyberSecurity counts 216 fixes across the bulletin's two patch levels. Our tally of the bulletin's tables finds 23 rated critical:

Everything else is rated high. Arm, Imagination Technologies (GPU), Unisoc and Qualcomm also contributed high-severity fixes.

Google says it will publish the matching source patches to the Android Open Source Project within 48 hours of the bulletin, which is when independent researchers can start picking the fixes apart.

Two patch levels: the one you want is 2026-11-05

Google splits each bulletin so phone makers can ship part of it sooner:

• 2026-11-01 covers the Android runtime, Framework, System and Google Play system update (Project Mainline) fixes — including CVE-2026-58868.
• 2026-11-05 includes all of the above plus the kernel and chip-vendor fixes (Arm, Imagination, MediaTek, Qualcomm, Unisoc).

Per the bulletin, only a device showing 2026-11-05 or later has every fix. That matters here because 15 of the 23 critical bugs — the kernel, MediaTek modem and Qualcomm ones — are only in the later level.

Some fixes also travel through Google Play system updates, which Google can push without waiting for your phone maker. The bulletin lists 17 CVEs in that channel, in Media Codecs, MediaProvider, Wi-Fi, Telephony and Profiling components.

The "SMS of Death" bug is in this bulletin

The November bulletin lists CVE-2026-58882 as a critical denial-of-service flaw in System. TechRadar, reporting on November 2, identified that CVE as the "SMS of Death": a malformed WAP Push text message that crashes the phone process, dropping calls and cellular service without the user ever seeing a message. TechRadar says 20 or more such messages can push a phone into a reboot loop, that researcher Mark Blah released a proof of concept, and that end-of-life devices won't be fixed.

One discrepancy: TechRadar says Google's fix shipped in the October bulletin, while Google lists the CVE in November's. Either way, a phone on the November 2026 patch level is covered; one on an older patch level may not be.

What to do

1. Check your patch level. On most phones it's under Settings → About phone → Android version → "Android security update" (the menu path varies by manufacturer). You want November 5, 2026 or later.
2. Install the update when your phone maker offers it. Google's Pixel update bulletin for November had not been posted when we checked; Samsung and other makers roll out on their own schedules.
3. Update Google Play system updates too. Its location in Settings varies by phone; search Settings for "Google Play system update". It carries some of these fixes independently of the monthly OS update.
4. Running an out-of-support phone? Devices that no longer get monthly patches won't receive these fixes, including the SMS crash bug. That's the clearest reason yet to retire one.
5. For IT teams: treat devices below 2026-11-01 as missing a critical zero-click fix, and set your mobile device management compliance baseline to 2026-11-05 once vendors ship it.

What to watch

The AOSP source drop due this week will show exactly what CVE-2026-58868 is, and that's typically when exploit research accelerates. If Google later updates the bulletin to flag any of these as exploited, the urgency changes — we'll update this story.