Android November 2026 security update fixes critical zero-click flaws

What happened

On 2 November 2026 Google published the Android Security Bulletin for November 2026. On 6 November it released version 1.1 with an updated list of issues. The bulletin covers Android 14, 15, 16 (including 16 QPR2) and 17, the Linux kernel used by Android, and components from chip vendors Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm.

Google rates CVE-2026-58868 in the Framework component as the most severe issue. It could lead to remote code execution with no additional execution privileges, and no user interaction is needed – the victim doesn't have to open or tap anything. Like every Android bulletin, the severity assumes the platform's built-in protections are turned off or have been bypassed.

Two more critical remote code execution bugs are in the System component: CVE-2026-58876 and CVE-2026-58936. The System section also lists three critical elevation of privilege bugs and two critical denial of service bugs.

The bulletin doesn't say that any of these issues are being exploited. That matters because Google sometimes flags "limited, targeted exploitation" in its bulletins, and this month it doesn't. Google does, however, say it publishes the source code patches to the Android Open Source Project (AOSP) within 48 hours. From then on, anyone can study what was fixed – including attackers.

Technical details

The NVD records for the three critical code execution bugs give a little more detail than the bulletin. We describe them only at the level needed to understand the risk:

• CVE-2026-58868 (Framework) – a possible out-of-bounds write caused by a heap buffer overflow in onOutputReceived in FrameDecoder.cpp (CWE-787). That file is part of Android's media code that decodes frames from media files.
• CVE-2026-58876 (System) – use-after-free memory corruption in several places (CWE-416). The bulletin's Google Play system updates table lists this CVE under Media Codecs.
• CVE-2026-58936 (System) – a possible use-after-free in png_set_tRNS in pngset.c (CWE-416). That function belongs to libpng, the library that processes PNG images.

All three are memory-safety bugs in code that parses media or images. NVD lists the same vector for each: network attack vector, low complexity, no privileges and no user interaction. CISA's SSVC assessment in NVD records exploitation: none, automatable: yes and technical impact: total. NVD itself hadn't finished its own analysis when we checked ("Undergoing Analysis").

Beyond the three headline bugs, the bulletin is large:

• Framework and System – dozens of high-severity elevation of privilege, information disclosure and denial of service bugs, plus one high-severity information disclosure in the Android runtime.
• Kernel – six critical issues: elevation of privilege in Bluetooth (two), pKVM (two) and HID, and information disclosure in pKVM. The rest are high severity in areas such as TLS, networking, FUSE, NFC and DMA buffers.
• Chip vendors – eight critical MediaTek modem bugs and one critical Qualcomm closed-source bug, as rated by the vendors. Arm (Mali GPU, CPU), Imagination (PowerVR GPU), Unisoc and Qualcomm add more high-severity fixes.

Two patch levels

On a phone, the fix shows up as a date. The November bulletin uses two:

• 2026-11-01 – fixes the Android runtime, Framework, System and Google Play system update sections.
• 2026-11-05 – additionally fixes the kernel, Arm, Imagination, MediaTek, Unisoc and Qualcomm sections. This level fixes every issue in the bulletin.

Some fixes – in media codecs, MediaProvider, telephony and Wi-Fi – also reach phones running Android 10 or later through Google Play system updates. They don't replace the full security update from your phone maker.

Who is affected

Anyone with an Android phone or tablet – Samsung, Google Pixel, Xiaomi, Motorola, OnePlus and others – running Android 14 to 17 without the November patch level. Kernel and chip-vendor fixes depend on the hardware inside the phone: the MediaTek modem bugs, for example, only matter on phones with MediaTek chips.

When you get the update depends on the manufacturer and model. Some brands ship it within days, others weeks later. Devices that no longer get security updates stay vulnerable – older Android versions aren't listed in the bulletin simply because Google no longer patches them.

How to tell if you were compromised

Google hasn't published any indicators of compromise, and with no reported exploitation there are none to share. Phone owners can't realistically detect an attack on these bugs themselves. Signs that a phone may be compromised in general – unknown apps, apps with accessibility or device admin rights you didn't grant, unexplained battery drain or data use – aren't specific to these flaws.

For organisations that manage Android devices:

• Check patch levels in your MDM and flag devices below 2026-11-05, or below 2026-11-01 for devices where the vendor hasn't shipped the second level yet.
• Watch for unusual app installs and new device admin or accessibility permissions on managed devices.
• Treat unsupported devices as a risk and restrict their access to company data.

If you suspect a phone has been compromised, our guide to what to do after a hacked account covers changing passwords and signing out other sessions from a clean device.

What to do

1. Check your patch level. Open Settings → About phone → Android version and look at Android security update. You're fully protected against this bulletin from 5 November 2026 (2026-11-05) onwards. Menu names differ slightly between manufacturers.
2. Update. Go to Settings → System → Software update (or follow your manufacturer's instructions) and install what's available. Use Wi-Fi and keep the battery at least 75% charged.
3. Update Google Play system too – on the same screen as the Android version, tap Google Play system update.
4. Restart when asked. Pixel phones install updates in the background and apply them on restart.
5. If the update hasn't arrived yet, check again in a few days. Until then, install apps only from Google Play and don't open images or media files from strangers.
6. Organisations: set a compliance rule in your MDM for patch level 2026-11-05 and a deadline for users to update.

If your phone gets lost or stolen, see what to do when your phone is stolen. And if a text asks you to sign in through a link, check the address first in our link checker – it sends only the address you choose to check, and only to our own server.

Timeline

Updates

• 13 November 2026 – one-week review: the bulletin is still at version 1.1 (6 November) and Google reports no exploitation of any of the flaws. NVD completed its analysis of CVE-2026-58868 on 10 November (CVSS 9.8, exploitation "none"), and the flaw is not in the CISA KEV catalog. No other changes.