Android November 2026 Security Update: 216 Fixes Guide

Google published the Android Security Bulletin for November 2026 on November 2. It lists 216 vulnerabilities. Twenty-three are rated Critical. Devices need a security patch level of 2026-11-05 or later to address every issue in the bulletin.

The most severe problem is a critical remote code execution flaw in the Framework component (CVE-2026-58868). An attacker needs no extra privileges and no user interaction. The same bulletin also covers the SMS of Death bug (CVE-2026-58882), a critical denial-of-service issue that can crash the phone process with a crafted message.

If your phone still shows an older patch date, install the update as soon as your manufacturer offers it. Pixel devices usually receive these fixes first. Other brands follow their own schedules.

What the November 2026 bulletin covers

The bulletin splits fixes across two patch levels.

• 2026-11-01 covers issues in Android Runtime, Framework, and System (including Google Play system updates).
• 2026-11-05 adds kernel and chipset fixes from Arm, Imagination Technologies, MediaTek, Unisoc, and Qualcomm.

A device that reports 2026-11-05 or later includes all applicable fixes from both levels and previous bulletins. A device that only reports 2026-11-01 has the first set but not necessarily every kernel or vendor fix.

Google lists updated AOSP versions for Android 14, 15, 16, 16 QPR2, and 17. Older versions such as Android 12 and 13 are not listed for the critical Framework and System fixes. Manufacturers decide whether to back-port patches to out-of-support releases.

Key critical issues

Three remote code execution flaws stand out because they require no user interaction:

• CVE-2026-58868 in Framework (Critical RCE).
• CVE-2026-58876 in System (Critical RCE).
• CVE-2026-58936 in System (Critical RCE).

The SMS of Death (CVE-2026-58882) is a critical denial-of-service flaw in the System component. A specially crafted WAP Push message can crash the telephony process, drop active calls (including emergency calls), and in some cases trigger a reboot loop. Researcher Mark Blaszczyk reported it in May 2026 and published details in late October. The November bulletin rates it Critical and lists fixes for Android 14 through 17.

Google Play Protect and platform mitigations reduce the chance of successful exploitation on most devices, but the official advice remains to install the latest security patch.

How to check your security patch level

Open Settings on your phone.

1. Go to About phone (or About tablet).
2. Tap Android version.
3. Look for the Android security update date.

You want to see 2026-11-05 or a later date. The exact menu names vary by manufacturer. Samsung users often find the same information under Software information. Pixel users can also check Settings > System > Software updates.

Also check the Google Play system update date in the same Android version screen. Play system updates can deliver some Framework and System fixes independently of a full OS update.

If the date is older than November 2026, proceed to the install steps below.

How to install the November 2026 update

The path differs slightly by brand, but the core steps are the same.

1. Connect to Wi-Fi and charge the phone above 50 percent.
2. Open Settings > System > Software update (or the equivalent on your device).
3. Tap Check for update.
4. If the November patch is available, download and install it.
5. Restart when prompted.
6. Return to About phone > Android version and confirm the security update date now reads 2026-11-05 or later.

On Pixel phones the update usually appears within a few days of the bulletin. Samsung, OnePlus, Xiaomi, and other brands release on their own cadence. Carrier-branded devices can take longer.

If no update appears after several days, visit your manufacturer’s support site and search for your exact model plus “November 2026 security update.” Some devices receive the fixes through a Google Play system update even when a full firmware package is delayed.

What to do if your phone is no longer supported

Phones that have reached the end of their security support window will not receive the November fixes. Android 12 and 13 devices fall into this category for many of the critical issues listed in the bulletin.

For those devices:

• Keep Google Play Protect enabled.
• Avoid installing apps from unknown sources.
• Use a secondary device or a VoIP app for critical calls if the telephony process is at risk.
• Consider upgrading to a phone that still receives monthly security updates.

You can also review the full list of fixed issues on the official Android Security Bulletin page.

Tips for staying current

• Enable automatic system updates where available.
• Check the security patch date at least once a month.
• Keep Google Play services and the Play Store updated.
• For Pixel owners, the Android Beta program offers early access to upcoming QPR builds that already contain later security fixes. See our guide to Android 17 QPR3 Beta 3 install steps.

Sources

• Android Security Bulletin—November 2026, source.android.com
• Google support: Check and update your Android version
• Researcher disclosures on CVE-2026-58882 (SMS of Death)

The November 2026 update is one of the larger monthly releases. Confirm your patch level today and install the update as soon as it appears for your device.