Android’s November update fixes 150 vulnerabilities

Google published the November 2026 Android security bulletin on November 2. The bulletin lists 150 vulnerabilities fixed in Android’s core components. If the device’s patch level is 2026-11-05 or later, all of these vulnerabilities are addressed.

The most serious vulnerability is in the Framework component

The bulletin’s highest-risk item is the critical vulnerability CVE-2026-58868 in the Framework component. According to Google’s description, this vulnerability can lead to remote code execution without requiring additional execution privileges. Exploitation does not require the user to tap a link or open a file.

There are two more critical remote code execution vulnerabilities in the System component: CVE-2026-58876 and CVE-2026-58936. On the kernel side, there are six critical privilege escalation vulnerabilities. These vulnerabilities do not compromise the device on their own, but they can allow a malicious app to escalate to system level.

Distribution of the 150 vulnerabilities

The distribution across the four sections on the AOSP side is as follows:

• Framework: 65 vulnerabilities
• System: 53 vulnerabilities
• Kernel components: 31 vulnerabilities
• Android runtime: 1 vulnerability

Fourteen of these 150 vulnerabilities are rated critical. The critical vulnerabilities are distributed as one in Framework, seven in System, and six in Kernel. Across the entire bulletin, including the chipmaker sections (Arm, MediaTek, Qualcomm, Unisoc, Imagination), more than 200 CVE numbers are listed.

Part of the bulletin concerns modules under Project Mainline. Fixes in the Media Codecs, MediaProvider, Telephony, and WiFi components can also be delivered through the Google Play system update. Devices running Android 10 and later can receive these patches without waiting for a manufacturer update. Google states that it will publish the AOSP source code patches within 48 hours of the bulletin’s publication.

What users should do

On the phone, you can check for a new update via Settings > Security (on some models, Settings > System > System update). After the update, you can verify from the Android version information screen whether the patch level is 2026-11-05.

The time it takes to roll out the patch varies by manufacturer. On brands such as Samsung, Xiaomi, and Oppo, the update may arrive weeks after the bulletin is published, leaving the device vulnerable to the vulnerabilities in the bulletin during that time. Mainline patches can also be checked separately via Play Store > Profile > Settings > Google Play system update.

None of the vulnerabilities in the bulletin currently appear on CISA’s actively exploited vulnerabilities list. Still, because the remote code execution vulnerabilities in the Framework and System sections do not require user interaction, the update should not be delayed.

Source: Android Security Bulletin, November 2026 (Google)