Google's November Android security update closes three critical flaws that could let an attacker run code on a phone remotely, with no tap or click from its owner. None is flagged as exploited, but the overall fix count is large: 215 vulnerabilities across two patch levels, according to the Android Security Bulletin for November 2026.
Google published the bulletin on 2 November and revised it on 6 November. It says the most severe issue is a critical vulnerability in the Framework component that could lead to remote code execution with no additional execution privileges and no user interaction.
Three remote bugs, no user action needed
Google's CVE records describe each critical remote bug in a single sentence:
- CVE-2026-58868 (Framework): a possible out-of-bounds write due to a heap buffer overflow in onOutputReceived of FrameDecoder.cpp.
- CVE-2026-58876 (System): a possible memory safety issue due to a use-after-free in multiple locations.
- CVE-2026-58936 (System): a possible memory corruption due to a use-after-free in png_set_tRNS of pngset.c.
For all three, Google states the result could be remote code execution with no additional privileges, and that user interaction is not needed. Google rates them Critical but publishes no CVSS score of its own. CISA's enrichment of the CVE records scores each one 9.8 and records exploitation as "none". Google has not said how a malicious input would reach these components, and that detail should be treated as unknown.
The 2026-11-01 patch level also carries five more critical System bugs: three privilege escalation flaws (CVE-2026-55275, CVE-2026-55283 and CVE-2026-58984), which CISA's enrichment scores at 8.4, and two denial-of-service flaws (CVE-2026-58814 and CVE-2026-58882). Every other entry at that level is rated High.
Two patch levels, 215 fixes
The fixes cover Android 14, 15, 16, 16 QPR2 and 17, although some bugs affect only a subset of those versions. The 2026-11-01 level carries 118 fixes: one in the Android runtime, 65 in Framework and 52 in System. The 2026-11-05 level adds 97 more in the kernel and in components from Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm, including Qualcomm closed-source code.
Earlier this week we reported on GhostMap, a crash-loop flaw that Google declined to fix through a security bulletin. The November update is the other side of that ledger: the bugs Google does treat as urgent.
Look for security patch level 2026-11-05
On the phone, the Android security update date in Settings shows the patch level. A device reporting 2026-11-01 has the Framework and System fixes, including all three remote bugs. A device reporting 2026-11-05 has everything in the bulletin. Device makers ship the November patches on their own schedules, so the date on the device is what counts, not the date of the bulletin.
Peru's National Digital Security Center highlighted CVE-2026-58868 in its integrated digital security alert 219-2026.
With nothing exploited yet, this is the cheap moment to update. Once a fix is public, the bug it fixes is no longer a secret.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.