TL;DR: Google published the November 2026 Android Security Bulletin on November 2, 2026. It lists 216 vulnerabilities, 23 of them Critical, across two patch levels: 2026-11-01 and 2026-11-05. The worst is a remote code execution bug in Framework (CVE-2026-58868) that needs no user interaction. Google doesn’t say any of the bugs are being exploited. Phones running Android 14, 15, 16 and 17 are covered. Samsung posted its November bulletin the same week and says Galaxy updates roll out over the next couple of weeks. The Pixel November update arrived on November 10, 2026 with the November Pixel Drop, for the Pixel 6a and newer (see our Pixel November update guide). Once it’s offered, install it: a patch level of November 5, 2026 or later means you have every fix.
Last updated: November 12, 2026. By Veer. Facts checked against Google’s Android Security Bulletin for November 2026, the Wear OS bulletin, the Pixel Update Bulletins index, Samsung’s November 2026 security bulletin, Google’s Android update help page, and reporting by SecurityOnline, Sammy Fans, SamUpdater and 9to5Google. This is a researched news explainer. We’ll update it when the Pixel update and the first Galaxy builds arrive.
Update (November 12, 2026): the Pixel update is out. Google published the November 2026 Pixel Update Bulletin on November 10. It brings supported Pixels (Pixel 6a and newer) to patch level 2026-11-05 and adds 166 Pixel-specific fixes, 43 of them Critical in our count, with none flagged as exploited. The Pixel 6 and 6 Pro are not included. Details: Pixel November update 2026 and, for the new features that came with it, November Pixel Drop 2026.
Update (November 7, 2026): Google’s Pixel Update Bulletins index still listed October 2026 (patch level 2026-10-05) as the latest Pixel entry when we rechecked on November 7. The November Android bulletin has been public since November 2, but the matching Pixel OTA has not shipped yet. Full status, lag table and what to do: Pixel November update 2026.
What’s in the Android November 2026 security update?
It fixes 216 security bugs, which makes it a very big month. By our count of Google’s tables, 119 are in the 2026-11-01 patch level and 97 more in 2026-11-05. Twenty-three are rated Critical and the other 193 are High (Android Security Bulletin). SecurityOnline reports the same totals, 216 fixes with 23 critical (SecurityOnline). Some trackers show a slightly lower number, such as 208 at CyberStack, depending on how they count CVEs that appear in more than one table.
| November 2026 bulletin | Number |
|---|---|
| Published | November 2, 2026 (version 1.0) |
| Total CVEs | 216 |
| Critical | 23 |
| High | 193 |
| In patch level 2026-11-01 | 119 (8 Critical) |
| In patch level 2026-11-05 | 97 (15 Critical) |
| Android versions patched | 14, 15, 16, 16 QPR2, 17 |
| Flagged as exploited in the wild | None |
Source: our count of the tables in Google’s November 2026 Android Security Bulletin, excluding the Google Play system update summary table.
The two patch levels matter. Google puts fixes for the core Android code in 2026-11-01 and fixes for kernel and chip-maker parts (MediaTek, Qualcomm, Arm, Imagination, Unisoc) in 2026-11-05. Only a phone showing 2026-11-05 or later has all 216 fixes. Google says source patches go to AOSP within 48 hours of the bulletin.
Where the bugs are, by our count:
| Component | CVEs |
|---|---|
| Framework | 65 |
| System | 53 |
| Kernel | 31 |
| MediaTek | 30 |
| Imagination Technologies (GPU) | 12 |
| Qualcomm | 9 |
| Qualcomm closed-source | 8 |
| Unisoc | 4 |
| Arm | 3 |
| Android runtime | 1 |
Google also published a separate Wear OS bulletin on November 2 with two extra High-severity bugs for smartwatches, on top of the main Android fixes.
What are the critical bugs?
The most serious is CVE-2026-58868, a Framework bug that could let an attacker run code remotely without any extra permissions or any tap from you. Google’s summary says: “The most severe of these issues is a critical security vulnerability in the Framework component that could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation” (Google). SecurityOnline says the bug is a heap buffer overflow in FrameDecoder.cpp (SecurityOnline).
All 23 Critical bugs:
| CVE | Area | Type | Patch level |
|---|---|---|---|
| CVE-2026-58868 | Framework | Remote code execution | 2026-11-01 |
| CVE-2026-58876 | System (Media Codecs) | Remote code execution | 2026-11-01 |
| CVE-2026-58936 | System | Remote code execution | 2026-11-01 |
| CVE-2026-55275, CVE-2026-55283 | System (Android 16 and 17) | Elevation of privilege | 2026-11-01 |
| CVE-2026-58984 | System (Android 15 to 17) | Elevation of privilege | 2026-11-01 |
| CVE-2026-58814, CVE-2026-58882 | System | Denial of service | 2026-11-01 |
| CVE-2026-53256, CVE-2026-89774 | Kernel, Bluetooth | Elevation of privilege | 2026-11-05 |
| CVE-2026-59044, CVE-2026-59045 | Kernel, pKVM | Elevation of privilege | 2026-11-05 |
| CVE-2026-59048 | Kernel, pKVM | Information disclosure | 2026-11-05 |
| CVE-2026-80604 | Kernel, HID | Elevation of privilege | 2026-11-05 |
| CVE-2026-20499, -20519, -20520, -20545 to -20549 (8 bugs) | MediaTek modem | Not stated | 2026-11-05 |
| CVE-2026-25285 | Qualcomm closed-source | Not stated | 2026-11-05 |
Source: Google. Google and the chip makers don’t publish full details for modem and closed-source bugs.
Three of the Critical bugs can be triggered remotely, and eight sit in MediaTek modem firmware, which handles the phone’s cellular connection. That’s why this month is worth installing quickly, even though Google doesn’t report any attacks.
Are any of these bugs being exploited?
No, not as far as Google says. Google adds a note to the bulletin when it has signs of “limited, targeted exploitation,” and the November bulletin has no such note. SecurityOnline also reports no exploitation in the wild (SecurityOnline).
That can change. Once patches are public, attackers can compare old and new code to work out how a bug works. If any November bug gets added to an exploited list, we’ll add it here.
When will Pixel phones get the November update?
Update, November 12: they’re getting it now. Google published the November 2026 Pixel Update Bulletin on November 10, 2026 (patch level 2026-11-05), and the rollout is staged. See our Pixel November update guide. The text below is from November 7.
Not yet. As of November 7, 2026, Google’s Pixel bulletin page still listed October 2026 as the latest Pixel update (Pixel Update Bulletins). Google says Pixel phones “start receiving OTA updates on the same day the monthly bulletin is released,” and that it takes about one and a half weeks to reach every Google device.
In 2026, seven of the ten Pixel updates landed a day after the Android bulletin. The rest came one to two weeks later:
| Month | Android bulletin | Pixel update |
|---|---|---|
| November 2025 | November 3, 2025 | November 11, 2025 |
| December 2025 | December 2, 2025 | December 2, 2025 |
| January 2026 | January 5, 2026 | January 12, 2026 |
| March 2026 | March 2, 2026 | March 3, 2026 |
| June 2026 | June 1, 2026 | June 16, 2026 |
| September 2026 | September 8, 2026 | September 15, 2026 |
| October 2026 | October 5, 2026 | October 6, 2026 |
Pixel dates from Google’s Pixel Update Bulletins index; Android bulletin dates from Google’s bulletin index.
Pixel 6 and Pixel 6 Pro owners shouldn’t expect this update. Google’s guaranteed support for them ended in October 2026, and these 216 bugs will stay open on those phones unless Google makes an exception. Our Pixel 6 end of support guide covers what to do next.
Separately, Google shipped its November Google System Updates on November 2, including Google Play services v26.43 and Play Store v53.9 (9to5Google). Those are feature and app updates, not the monthly security patch.
When will Samsung Galaxy phones get it?
Samsung has published its November bulletin, but no Galaxy phone had the November patch yet when this was written. Samsung’s SMR-NOV-2026 bulletin covers Android 14, 15, 16 and 17 devices (Samsung). Sammy Fans counts 178 Android fixes in it (20 Critical, 157 High, 1 Moderate), plus 24 Samsung-specific fixes, and reports that the rollout comes “over the next couple of weeks” (Sammy Fans).
| Google Pixel | Samsung Galaxy | |
|---|---|---|
| November bulletin out? | Not yet (as of Nov 2, US time) | Yes, SMR-NOV-2026 |
| Android Critical bugs included | All 23 expected | 20 (Samsung lists some as already fixed or not applicable) |
| Phone-maker-specific fixes | Will be in the Pixel bulletin | 24 Samsung fixes plus 4 for Samsung Semiconductor chips |
| November update installed on any model? | No | None recorded on SamUpdater as of Nov 3 |
| Latest patch on current flagships | October 2026 | October 2026 (Galaxy S26, S25, S24, Z Fold7, Z Flip7) |
Samsung’s own fixes include three High-rated bugs: an out-of-bounds write in the bootloader that needs physical access, a camera library flaw that could let code run locally but needs you to interact with it, and a stack overflow in a system library (Samsung). Samsung usually ships flagship models first. If you’re waiting on a bigger update too, our One UI 9 update schedule tracks which Galaxy phones get it and when.
How do I check and install the update?
Open Settings, check your security patch level, then look for an update. Google’s steps for most Android phones (Google):
- Check your patch level: go to Settings > About phone > Android version and look at Android security update. On a Galaxy phone, it’s Settings > About phone > Software information.
- Update a Pixel: go to Settings > System > Software updates and follow the steps. Pixels install in the background, and the update becomes active after a restart.
- Update a Galaxy: go to Settings > Software update > Download and install.
- Update Google Play system: in the same Android version screen, tap Google Play system update. Some November fixes, including the Media Codecs RCE (CVE-2026-58876), are in parts of Android that Google can patch this way (Google).
Google suggests using Wi-Fi and having at least 75% battery before you start. Google notes that update timing varies by device, manufacturer and mobile carrier, so phones bought through a US or UK carrier can get it on a different day from unlocked ones.
What if my phone runs Android 13 or older?
Google’s November fixes only list Android 14 through 17, so older phones don’t get them from Google. Some phone makers patch older versions themselves, but if your phone stopped getting monthly updates, it will now collect unfixed bugs every month. Keep apps updated through Google Play, avoid sideloading apps, and watch for the signs in our guide to how to tell if your phone is hacked. For the iPhone side, see which iPhones still get security updates.
FAQ
What is the Android November 2026 security update?
It’s Google’s monthly set of Android security fixes, published on November 2, 2026. It fixes 216 vulnerabilities, 23 rated Critical, for devices running Android 14, 15, 16 and 17. The two patch levels are 2026-11-01 and 2026-11-05.
What is the most serious bug in the November update?
CVE-2026-58868, a Critical remote code execution bug in Android’s Framework. Google says it needs no extra permissions and no user interaction. It’s fixed in patch level 2026-11-01.
Is any November bug being actively exploited?
Google hasn’t marked any of them as exploited. The bulletin has no note about limited, targeted exploitation this month.
What patch level do I need?
2026-11-05 or later. That patch level includes all 216 fixes. A phone showing 2026-11-01 has the core Android fixes but not the kernel and chip fixes.
When will my Pixel get the November 2026 update?
It’s out. Google published the November 2026 Pixel Update Bulletin on November 10, 2026, and the update is rolling out in stages to the Pixel 6a and newer, with patch level 2026-11-05. Pixel 6 and 6 Pro are not included because their support ended in October 2026. See our Pixel November update guide.
When will Samsung release the November 2026 update?
Samsung published its November bulletin, and Sammy Fans reports the rollout comes over the next couple of weeks, usually starting with flagships. No Galaxy model had it yet as of November 3.
How do I update my Android phone?
Go to Settings > System > Software updates on a Pixel, or Settings > Software update > Download and install on a Galaxy. Check your patch level under Settings > About phone.
Sources
- Google, Android Open Source Project: Android Security Bulletin, November 2026, Wear OS Security Bulletin, November 2026, Pixel Update Bulletins, Android Security Bulletins index
- Google: Check & update your Android version
- Samsung: Samsung Mobile Security, November 2026
- SecurityOnline: Android security update fixes remote code execution flaws (Nov 3, 2026)
- CyberStack: Android November 2026 security bulletin
- Sammy Fans: Samsung November 2026 security patch details (Nov 2, 2026)
- SamUpdater: Samsung November 2026 security update tracker
- 9to5Google: What’s new in Android’s November 2026 Google System Updates (Nov 2, 2026)
