Android’s November 2026 Updates Patch Over 200 Vulnerabilities

What it is

Google's November 2026 Android bulletin ships two patch levels: 2026-11-01 (119 flaws) and 2026-11-05 (97 bugs). Together they fix more than 200 vulnerabilities, including about two dozen rated critical. The most severe is CVE-2026-58868 in Framework. Google describes it as remote code execution with no additional execution privileges and no user interaction needed. The page gives no mechanism for it.

Affected

The 2026-11-01 level breaks down as follows:

• Framework: 65 flaws.
• System: 53 flaws.
• Android runtime: one high-severity information disclosure bug.

System also received critical-severity RCE, elevation of privilege and denial-of-service fixes.

The 2026-11-05 level covers Kernel, Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm components. Most fixes are high severity, but more than a dozen are critical. The critical ones are in Bluetooth, pKVM, HID, the MediaTek modem and a Qualcomm closed-source component.

Android XR and Wear OS received separate bulletins. The XR update fixes one extra high-severity Framework flaw beyond the main bulletin. Wear OS fixes two extra high-severity flaws, one in Framework and one in System.

What to do

• Check that devices report a security patch level of 2026-11-05 or later. Google states that this level addresses all of the issues in both parts. A device at 2026-11-01 only has the Android runtime, Framework and System fixes, not the Kernel, Arm, MediaTek, Unisoc, Imagination or Qualcomm ones.
• Seventeen of the 2026-11-01 flaws were already patched before the monthly release through Google Play system updates. Devices that receive those updates may therefore be covered for those issues before the full OTA arrives.
• Devices with MediaTek, Unisoc or Qualcomm silicon depend on the 2026-11-05 level for the critical modem and closed-source fixes. Wear OS and Android XR devices need their own updates for the extra Framework and System flaws.

Caveats

The page does not list CVE ids beyond CVE-2026-58868. It does not say which 17 flaws shipped through Play system updates. It also does not report any exploitation in the wild.