Google Android Security Bulletin published November 2, 2026; coverage November 4 to 6, 2026
216 Fixes and One Zero-Click Flaw: the Android November Bulletin Turns on a Patch Level Most Phones Do Not Show
Google November 2026 Android Security Bulletin, published November 2, lists 216 vulnerabilities, 23 of them rated Critical. The headline flaw is CVE-2026-58868, a Critical remote code execution issue in the Android Framework: a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp that can produce an out-of-bounds write and let a remote attacker run code with no user interaction and no additional execution privileges. It affects Android 14, 15, 16, 16 QPR2, and 17. Two more Critical remote code execution flaws, CVE-2026-58876 and CVE-2026-58936, sit in the System component, six Critical flaws sit in the kernel, and the bulletin formally lists CVE-2026-58882, the WAP Push SMS denial-of-service flaw in decodeWapPdu. Google splits the fixes across two patch levels: 2026-11-01 covers 119 flaws across the runtime, Framework, and System, including CVE-2026-58868, and 2026-11-05 adds 97 more across the kernel and vendor components from Arm, Imagination Technologies, MediaTek, Unisoc, and Qualcomm, so only a device at 2026-11-05 or later carries the whole bulletin. As of November 4, Google reported no exploitation of the bulletin flaws, and none appeared in the CISA KEV catalog as of its November 3 update. The bulletin gives no workaround for devices that cannot install the update yet, and delivery runs on manufacturer and carrier schedules, which is where the practical risk sits. Android 12 and 13 are not listed as affected by CVE-2026-58868, and Google records do not say whether they contain the flaw; separately, the SMS flaw researcher reports that Android 12 and 13 devices run the vulnerable telephony code without receiving its fix.
Executives
Android risk this month is a measurement problem before it is a patching problem. The fix exists, Google published it on November 2, but whether any given phone has it depends on its maker and carrier, and the only reliable evidence is the security patch level on the device itself. Ask for the fleet counted by patch level, how many devices sit below 2026-11-01, how many have reached 2026-11-05, and how many can never get there and need replacement or restricted access. A statement that the update was released is not a statement that the estate is covered.
CIO / CISO
Set 2026-11-05 as the verification target for the full bulletin and 2026-11-01 as the minimum for the Framework flaw, and keep the two distinct in reporting, because a device can satisfy the headline CVE and still miss the kernel and chipset fixes. Distinguish the Android security patch level from the Google Play system update date in every inventory; they are different mechanisms, and CVE-2026-58868 is not delivered by Play updates. Give older devices an explicit disposition: Android 12 and 13 are outside the listed scope for the Framework flaw, but the telephony flaw reporting names them as unpatched for CVE-2026-58882, so unmanaged older phones deserve a decision, not an assumption.
Engineers
Verify by reading the patch level from the device or a validated inventory, in Settings, About phone, Android version, and chase the exceptions: manufacturer delays, carrier holds, and end-of-support models. There is no workaround to apply while waiting, so compensating controls are about exposure: restrict sensitive access from devices below 2026-11-01 until they update or are replaced. Keep the exploitation status accurate in tickets: as of the November 4 coverage, no bulletin flaw was reported exploited and none was in the KEV catalog, so this is a severity-driven priority, not an incident.
Everyone (non-IT)
Check your own phone this week: open Settings, tap About phone and then Android version, and look at the Android security update date. November 1, 2026 or later means the most serious flaw in this bulletin is fixed on your phone; November 5 or later means the whole set is. If your date is older, install any update your phone offers. If it offers none and the date stays old, the phone has likely reached the end of its update life, which is worth knowing before you rely on it for banking or work sign-ins.