Android November 2026 Security Update: 23 Critical Flaws

The Android November 2026 security bulletin fixes 216 vulnerabilities, 23 of them Critical, including CVE-2026-58868, a heap buffer overflow in FrameDecoder.cpp that could allow remote code execution with no user interaction on Android 14 through 17. Google reports no active exploitation. Phones are protected once they show a security patch level of 2026-11-01 or later, and 2026-11-05 covers every fix in the bulletin.

CVE-2026-58868 is an out-of-bounds write in the onOutputReceived function of FrameDecoder.cpp. The Android Security Bulletin says it could lead to remote code execution with no additional privileges and no user interaction. Neither the bulletin nor the CVE record says how an attacker would reach that code, and Google's Critical rating assumes Android's built-in platform protections are turned off or bypassed. As of November 4, Google had not reported any attacks, and none of the bulletin's flaws was in CISA's Known Exploited Vulnerabilities catalog, according to The Hacker News.

The bulletin is unusually large. Of the 216 flaws, two more Critical issues, CVE-2026-58876 and CVE-2026-58936 in Android's System component, could also allow remote code execution. Six Critical flaws are in the kernel, two of them in Bluetooth code, and the most severe kernel flaw could allow a remote attacker to gain elevated privileges without user interaction. The 2026-11-05 patch level adds Critical fixes in MediaTek modem code and a closed-source Qualcomm component. MediaTek's November bulletin describes its Critical modem flaws as out-of-bounds writes and says it is not aware of active exploitation.

What is the "SMS of Death" Android bug?

Another Critical flaw, CVE-2026-58882, could allow a remote denial of service with no user interaction. It sits in decodeWapPdu, the function that handles WAP Push messages delivered over SMS. On October 29, a researcher published a write-up called "SMS of Death" about a bug in the same function. In that write-up, one malformed WAP Push message crashes com.android.phone and ends any active call, including emergency calls. The attacker needs only the phone number, the message never appears in the inbox, and the phone retries it on every boot, so it can crash at startup until the message is removed. A proof-of-concept app is public. Neither Google's bulletin nor the CVE record confirms that CVE-2026-58882 is the same bug, and the researcher says Android 12 and 13 run the same code but do not get the fix.

How do you check if your Android phone has the November 2026 patch?

Open Settings, then About phone, then Android version, and read the Android security update date. That date is your security patch level.

Google sets two patch levels so phone makers can ship the common fixes sooner, and makers and carriers deliver them on their own schedules. There is no workaround for phones that cannot install it yet, according to Google's help page. For fleets, the useful check is the reported patch level in your mobile device management console, not the Android version.

Our read

Most of this month's Critical bugs are not exploited, and EPSS for CVE-2026-58868 is only 0.2%. The real risk sits in the delay between Google's bulletin and the day each device in your fleet actually reports 2026-11-05. That gap is set by phone makers and carriers, not by you, and older Android 12 and 13 phones may never close it for the SMS crash bug. Treat patch level as evidence you check, not an assumption, and retire devices that no longer receive bulletins. Apps you ship to those devices still need their own testing, because the operating system is only one layer. For context on recent exploited Android bugs, see our coverage of the Pixel zero-day CVE-2026-58704 and the Bad Epoll root flaw. For how to rank a 216-flaw month, see our guide to prioritizing vulnerabilities with CVSS, EPSS and KEV. To test your own mobile apps and the APIs behind them, Nexus Void runs VAPT on web apps, APIs and mobile apps.

Reporting by The Hacker News; fixes per the Android Security Bulletin and MediaTek; EPSS per FIRST.