Android's November 2026 bulletin fixes 200+ flaws, critical RCE
Google's November Android bulletin patches 216 flaws, led by CVE-2026-58868, a critical zero-click Framework RCE. No in-the-wild exploitation flagged.
Google's Android Security Bulletin for November 2026 patches more than 200 vulnerabilities, led by a critical remote code execution flaw in the Framework that needs no user interaction. The most severe is CVE-2026-58868; Google says it "could lead to remote code execution with no additional execution privileges needed" and that "user interaction is not needed for exploitation." Get devices to the 2026-11-05 patch level.
What's affected
The bulletin splits into two patch levels. The 2026-11-01 level covers 119 defects in the Android runtime, Framework, System, and Google Play system update components; the 2026-11-05 level adds 97 in the kernel, Arm, Imagination, MediaTek, Unisoc, and Qualcomm components — 216 in total, with roughly two dozen rated critical, per SecurityWeek.
CVE-2026-58868 affects Android 14, 15, 16, 16-QPR2, and 17. Other critical issues named in the bulletin:
- System RCE: CVE-2026-58876, CVE-2026-58936.
- System elevation of privilege: CVE-2026-55275, CVE-2026-55283, CVE-2026-58984.
- Kernel EoP: CVE-2026-53256 and CVE-2026-89774 (Bluetooth), CVE-2026-59044 and CVE-2026-59045 (pKVM).
- Qualcomm: CVE-2026-25285, in a closed-source component.
The full list, with bug IDs and per-component severities, is in the bulletin.
Exploitation status
The bulletin does not flag any November issue as under limited or targeted exploitation — a contrast with recent months, where Google and CISA tagged in-the-wild bugs such as September's CVE-2026-58704, added to CISA's KEV catalog. Treat this as a routine-but-heavy rollup, not an emergency.
Action checklist
- Bring devices to the 2026-11-05 security patch level, which the bulletin says addresses every issue in both sections.
- Confirm the level under Settings → About phone → Android version. Pixel devices ship fixes day one; other OEMs lag by weeks, and some older models never receive them.
- For fleets, push the update through MDM and prioritize the 2026-11-05 level over 2026-11-01, since the critical kernel and vendor fixes live in the later set.
Context
A 200-plus bulletin is now the Android baseline, not a spike — the volume comes from the breadth of the stack (Framework, kernel, four silicon vendors) more than any single campaign. The one line worth reading closely each month is the exploitation note. This month it is clean; the unauthenticated, zero-click Framework RCE in CVE-2026-58868 is the reason not to let that stay the case on an unpatched device.