Android November 2026 Security Update Explained: Critical Zero-Click Flaw, 216 Fixes and How to Check Your Phone

Illustrative image: a smartphone in hand. A security patch has no product photograph, so this image stands in for the Android phones covered by the update. Image: Wikimedia Commons.

TL;DR — Android November 2026 security update: Google's November 2026 bulletin fixes 216 flaws, led by a critical zero-click flaw (CVE-2026-58868) that could let an attacker run code on Android 14, 15, 16 and 17 phones with no tap from you. The fix is in security patch level 2026-11-01 — check Settings > About phone > Android version, and install your maker's November update when it arrives.

UPDATE — 13 November 2026: CERT-In warning, and the rollout so far. India's CERT-In issued a critical advisory (CIVN-2026-0536) on 4 November 2026 urging Android 14–17 users to install this update immediately. Nine days on, the rollout is uneven: Samsung's Galaxy S26 phones in India are receiving the November patch, while only 1 of Xiaomi's 74 supported devices has it in any region and Xiaomi's India builds are still on October. See the new section below.

📌 KEY HIGHLIGHTS

• The headline flaw: CVE-2026-58868, a critical Framework bug that Google says could allow remote code execution with no additional privileges and no user interaction.
• Who is affected: phones and tablets on Android 14, 15, 16 (including 16 QPR2) and 17 that have not yet received the November patch.
• 216 flaws, 23 critical: the November bulletin covers the Android runtime, Framework and System at patch level 2026-11-01, plus kernel and chip-vendor fixes at 2026-11-05.
• No attacks reported: Google's bulletin does not flag any November flaw as exploited, and none was in CISA's exploited list as of 3 November — this is a patch-now story, not an active-attack story.
• The catch for India readers: Google publishes the fix, but your phone maker ships it — Samsung, Xiaomi, Vivo, OPPO and others roll it out on their own schedules, so the date on your phone is what matters.

Android November 2026 security update: what Google fixed

Google published its Android Security Bulletin for November 2026 on 2 November 2026, and The Hacker News reported the details on 4 November. The bulletin is split into two patch levels. Level 2026-11-01 carries the fixes for the Android runtime, Framework, System and Google Play system update components. Level 2026-11-05 adds the kernel and component fixes from chip suppliers — Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm. A device on 2026-11-05 or later is covered against everything in the bulletin; a device on 2026-11-01 is covered against the Framework, System and runtime flaws, including the headline bug.

The most severe issue is CVE-2026-58868. In plain terms, it is a heap buffer overflow — the program writes data outside its assigned workspace — in the onOutputReceived function of a file called FrameDecoder.cpp, part of Android's Framework. Google rates it Critical and says it could lead to remote code execution with no additional execution privileges needed, and that user interaction is not needed for exploitation. That "no user interaction" part is why it is being called a zero-click flaw: in the worst case, the victim would not need to tap anything.

Two honesty notes matter here. First, Google's Critical rating assumes the protections built into Android and Google's services are turned off or bypassed — it is a worst-case rating, not a claim that every phone is remotely exploitable as configured. Second, neither the bulletin nor the CVE record says how an attacker would actually reach this code, so nobody should claim a specific attack route yet. What is certain is the fix: security patch level 2026-11-01 or later.

The critical flaws in the November bulletin

Beyond the headline bug, the bulletin contains two more critical remote code execution flaws in the System component, plus a critical denial-of-service flaw. Here is the core list, as reported:

Flaw	Component	What it could allow	Fixed at
CVE-2026-58868	Framework (FrameDecoder.cpp)	Remote code execution, no user interaction	2026-11-01
CVE-2026-58876	System (use-after-free)	Remote code execution	2026-11-01
CVE-2026-58936	System (libpng png_set_tRNS use-after-free)	Remote code execution	2026-11-01
CVE-2026-58882	System	Remote denial of service, no user interaction	2026-11-01
Kernel + MediaTek / Qualcomm flaws	Kernel, modem and closed-source components	Various, including critical modem flaws	2026-11-05

Older versions are not in scope for the headline flaw: Android 12 and 13 are not listed as affected by CVE-2026-58868. That does not mean old phones are safe in general — it means this particular bug targets the newer Framework code — but owners of phones stuck on Android 13 or earlier should still install whatever update their maker offers, since those devices no longer receive Google's monthly bulletins at all.

Illustrative image: checking a phone for a new software version. The November fix arrives as your maker's over-the-air update, not as a download from Google. Image: Wikimedia Commons, CC BY 2.0.

Why it matters for India readers

India runs on Android. The overwhelming majority of phones sold here — from Samsung and Xiaomi to Vivo, OPPO, Realme and Google's own Pixels — run Android 14, 15, 16 or 17, which is exactly the affected range. A critical, no-interaction flaw in that range is therefore a mainstream story here, not a niche one.

But the fix does not arrive from Google directly for most readers. Google's Pixel phones get it first; everyone else waits for their maker and, in some cases, their carrier to package and ship it. Samsung's own November update is already a separate story — see our Samsung November 2026 security update India explainer — and Xiaomi, Vivo and OPPO will follow on their own timetables. The practical point: the date shown on your phone, not the date Google published the bulletin, decides whether you are protected. And the contrast with this week's other big patch story is instructive — see our WordPress core flaw exploited CISA explainer, where attacks were already confirmed; here, patching now is prevention, not damage control.

Update: CERT-In warning and the rollout so far (13 November 2026)

India's cyber agency did not wait. On 4 November 2026, the Indian Computer Emergency Response Team (CERT-In) issued vulnerability note CIVN-2026-0536 at critical severity, covering Android 14, 15, 16, 16 QPR2 and 17, and urged users and organisations to install the latest security updates immediately. CERT-In also recommends keeping Google Play Protect switched on while waiting for the manufacturer's update.

Nine days after the bulletin, the fix is still reaching phones at very different speeds. Pixel phones got it first, with the November update rolling out from 10 November. Samsung has started too: Galaxy S26 phones in Europe and India can now download the November patch (firmware ending BZK1, about 600 MB), and Samsung pushed updates to 27 devices in the week of 2–8 November. Xiaomi is far behind — as of 12 November, only 1 of its 74 supported devices has the November patch in any region, and its India builds are still on October. If your phone is a Xiaomi, Redmi or POCO, check Settings > About phone > Android version for the patch date rather than assuming the update has arrived.

Should you care?

✅ Yes — check your patch level today. If your Android security update date is older than 1 November 2026 and your phone runs Android 14–17, you are missing the fix for a critical zero-click flaw. ⏳ Don't panic, and don't sideload. No exploitation has been reported, and the fix comes through your maker's normal update — installing random firmware to jump the queue can break your phone and its warranty.

How to check: open Settings, go to About phone, then tap Android version — the "Android security update" date is shown there. If it reads 2026-11-01 or later, the headline flaw is fixed; 2026-11-05 or later means the whole November bulletin is covered. If it is older, go to Settings > System > Software update (the exact path varies by maker) and check for an update. If none is offered yet, your maker has not shipped it for your model — check again in a few days, and keep automatic updates on.

FAQs

What is the Android November 2026 security update? It is Google's monthly Android Security Bulletin for November 2026, published 2 November 2026. It fixes 216 vulnerabilities, 23 rated Critical, across the Android runtime, Framework, System, kernel and chip-vendor components, delivered to phones in two patch levels: 2026-11-01 and 2026-11-05.

Is CVE-2026-58868 being exploited? Not as far as anyone has reported. Google's bulletin does not flag any November flaw as exploited, and none of them was in CISA's Known Exploited Vulnerabilities catalog as of its 3 November update. That is good news — but it is also exactly when you should patch, before exploit code appears.

How do I check my Android security patch level? Open Settings, go to About phone, and tap Android version — the "Android security update" date is listed there. A date of 2026-11-01 or later covers CVE-2026-58868; 2026-11-05 or later covers the entire November bulletin, including kernel and chip-vendor fixes.

When will my phone get the November 2026 security update? It depends on your maker and carrier. Google's Pixel phones receive it first; Samsung, Xiaomi, Vivo, OPPO and others package and ship it on their own schedules, usually within weeks for recent flagships and longer for older or budget models. If no update is offered yet, your model has not received it — keep checking rather than sideloading firmware.

TAKEAWAY: The Android November 2026 security update fixes a critical zero-click flaw on Android 14–17, plus 215 more issues. Check your security patch date today, install your maker's November update when it lands, and don't wait for an attack to take patching seriously.

Check your patch level now — Settings > About phone > Android version — and if the November update is available, install it before the next app you open.

Sources

Android Security Bulletin — November 2026 (Google, published 2 November 2026)
The Hacker News — Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction (4 November 2026)
SecurityAffairs — CVE-2026-58868: Critical Android Bug Could Let Attackers Run Remote Code (4 November 2026)
News Karnataka — CERT-In issues critical Android security warning (documents advisory CIVN-2026-0536, issued 4 November 2026)
Xiaomi Firmware — Xiaomi Security Patch Status, November 2026 (checked 12 November 2026)
Samsung Magazine — These Samsung phones are getting the November update (12 November 2026)