Android November 2026 security update fixes 216 flaws, including a critical Framework bug

What changed this month

Google split the November fixes into two security patch levelsdates that tell you how current a phone's security fixes are. A phone on 2026-11-05 includes everything released up to that date., as it does every month. The 2026-11-01 level fixes 119 issues in the core of Android: 65 in the Framework, 53 in System and one in the Android runtime. The 2026-11-05 level adds 97 more in parts that sit closer to the hardware, such as the Linux kernel and chip components from MediaTek, Qualcomm, Imagination Technologies, Arm and Unisoc.

Google rates eight issues in the 2026-11-01 group as critical. The 2026-11-05 group has its own critical kernel bugs, most of them elevation of privilegea flaw that lets code already running on the device gain more permissions than it should have, plus critical ratings that MediaTek and Qualcomm gave to flaws in their own components.

CVE-2026-58868, the most severe flaw

The bulletin calls CVE-2026-58868 the most severe issue of the month. According to its CVE record, the bug sits in FrameDecoder.cpp, where a heap buffer overflowa program writes past the end of a memory area it reserved, which can corrupt nearby data and sometimes let an attacker run their own code can lead to remote code executionan attacker runs their own code on your device from a distance, for example through a file or message. The record states that user interaction is not needed.

CISA, the US cybersecurity agency, added a CVSS 3.1 score of 9.8 out of 10 to the record. Two other bugs in the System component, CVE-2026-58876 and CVE-2026-58936, received the same 9.8 score. The second one is in pngset.c, part of the code Android uses to handle PNG images. Each of the three affects Android 14, 15, 16, 16 QPR2 and 17.

Is anyone exploiting it?

Not as far as anyone has reported. Google adds a note to its bulletins when it has signs of "limited, targeted exploitation", and the November bulletin has no such note. CISA's assessment in the CVE records lists exploitation as "none" for the three critical bugs. That can change, and we will update this article if it does.

What is not public yet: Google has not described how an attacker would reach the vulnerable code, and the source code patches had not appeared in the Android Open Source Project when the bulletin went out. Google says they follow within 48 hours.

What you should do

1. Open your phone's settings and check the security patch level. Our guide on how to check the Android security patch level shows where to find it and how to read the date.
2. If the date is older than 2026-11-01, look for a system update under Settings > System > Software updates.
3. If no update is offered, it may not have reached your model yet. Google says update schedules depend on the device, the manufacturer and the carrier.

For IT teams managing Android fleets, 2026-11-05 is the level to require. Devices stuck on Android 13 or older are not listed in the bulletin at all, so they will not receive these fixes through Google's process.

The same week brought fixes for desktop software too. Mozilla patched 167 vulnerabilities in Firefox 159, and a WordPress flaw is already being used in attacks.