Android November Security Update Fixes a No-Tap Flaw You Should Patch Now

Android November security update: the flaw that needs nothing from you

The Android November security update is one of those patches you should install promptly rather than snoozing. Google's November 2026 bulletin, published November 2, lists more than 200 vulnerabilities, 23 of them rated Critical. The worst is CVE-2026-58868, a Framework flaw that Google says could allow remote code execution with no user interaction, no extra privileges, and no tap or click from the phone's owner.

That combination is what makes it serious. Most phone attacks need you to do something: open a file, tap a link, install an app. This one, as described, does not. The bug is a heap buffer overflow causing an out-of-bounds write in the onOutputReceived function of FrameDecoder.cpp, in Android's Framework component. In plain language, a crafted input can make the phone write data where it should not, and that can be turned into running an attacker's code.

The flaw affects Android 14, 15, 16 (including 16 QPR2) and 17, and it is fixed at security patch level 2026-11-01 or later. As of November 4, Google's bulletin did not report any attacks exploiting it, and none of the bulletin entries appeared in the US CISA Known Exploited Vulnerabilities catalog as of its November 3 update. That is good news, but it is not a reason to wait. Public CVE records and patch details give attackers a head start, and the window between disclosure and exploitation is measured in days, not months.

Two patch levels, and what each one covers

Google ships the November fixes in two patch levels, and knowing which one you have matters. Patch level 2026-11-01 covers the Android runtime, Framework and System fixes, including the critical Framework flaw and two more critical remote code execution bugs in System: CVE-2026-58876, a use-after-free, and CVE-2026-58936, a use-after-free in libpng's png_set_tRNS function.

Patch level 2026-11-05 adds the rest: kernel fixes and chip-vendor components from Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm. That level includes critical flaws in MediaTek modem code and a closed-source Qualcomm component. Devices on 2026-11-05 or later are protected against everything in the bulletin. Devices on 2026-11-01 are protected against the Framework and System flaws, which is the urgent part, but not the full list.

To check yours, open Settings, then About phone, and look for the Android security update date. If it says 2026-11-01 or later, you have the Framework fix. If it says 2026-11-05 or later, you have the complete November set. Our guide on how to check if your Android phone is actually up to date walks through the check in five minutes, including what to do when the date looks older than you expected.

The SMS flaw that crashes phones deserves its own warning

Buried in the same bulletin is CVE-2026-58882, a critical denial-of-service flaw with a memorable nickname: the SMS of death. A malformed WAP Push SMS can crash Android's telephony process, dropping any active call, including calls to emergency services, with no tap and no visible message. Researcher Mark B disclosed it with a working proof of concept on October 29, and Google's bulletin rates it Critical at the 2026-11-01 patch level.

The impact is denial of service, not code execution: the phone crashes, reboots, and can enter a loop that ends in a factory reset. That is bad enough on its own, but the coverage gap is worse. The flaw reproduces from Android 12 through Android 16, yet the fix covers Android 14 through 17. Android 12 and 13 devices, which still account for a meaningful share of global Android traffic, receive no patch. If you are on Android 12 or 13, there is no update coming for this one, and planning a replacement or retirement for that device is the honest advice.

Why phone makers and carriers set the real timeline

Google publishes the bulletin, but your phone maker and carrier decide when the patch reaches you. Pixel phones typically get it first, followed by Samsung and other major brands on their own schedules, with budget models and carrier-locked devices often trailing by weeks. That staggered rollout is normal, but it means the bulletin date and your install date are two different things.

What you can do while waiting:

• Check for updates manually in Settings rather than waiting for the notification.
• Keep Google Play system updates current, since some components update through Play independently of the monthly patch.
• Be extra cautious with messages and media from unknown senders until your patch level is current.
• Do not sideload apps or disable Play Protect to work around an unrelated problem.

None of that replaces the patch, but it narrows the window while you wait for it.

The bigger picture: monthly patches are the price of a modern phone

It is easy to treat monthly security updates as background noise, and most months they are. This month is a reminder of why they exist. A single bulletin can contain a no-interaction code execution flaw, a telephony crash bug, and dozens of modem and kernel issues, all fixed in one install. The iOS 27.3 beta shows the other side of the same coin: Apple is also shipping security and feature work on a monthly rhythm, and the platforms that patch fastest are the ones that age best.

Install the November update when it appears, check that your patch level actually moved, and if your device no longer receives updates, treat that as a real deadline rather than a minor inconvenience. An unpatched phone is not just an old phone. After a bulletin like this one, it is an exposed phone.