Google's November 2026 Android security bulletin fixes 216 vulnerabilities, according to eSecurity Planet's count, including roughly two dozen rated critical, among them three remote code execution flaws and a text-message bug that can crash a phone's calling service. Phones need the 2026-11-05 patch level to be fully covered.
What the bulletin covers
Google published the bulletin on November 2 with two patch levels, 2026-11-01 and 2026-11-05. It states that devices on 2026-11-05 or later are protected against all the issues it lists. The first level carries 119 fixes, split between the Framework component with 65, the System component with 53 and one in Android Runtime. The second level adds 97 fixes for the Linux kernel and for chip components from Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm.
Counts differ slightly between outlets. Techlicious puts the critical total at 23, while Samsung's own bulletin lists 20 critical Google fixes, so the figure you see depends on how a site counts the vulnerabilities that appear under both patch levels. Beyond the critical group, the bulletin lists many issues rated High, most of them privilege escalation flaws that span Android 14 through 17, so the update matters for anyone on a current version of the system.
The critical flaws
The most serious issue is in the Framework component. Google's bulletin describes a critical vulnerability, tracked as CVE-2026-58868, that can lead to remote code execution without any user action or extra privileges. Two more remote code execution flaws sit in the System component, CVE-2026-58876 and CVE-2026-58936. Techlicious reports that no real-world attacks using these three flaws are known.
Kernel entries are the other big group. The kernel section lists critical privilege escalation flaws in Bluetooth, pKVM and HID components, plus an information disclosure flaw in pKVM. MediaTek modem components account for another group of critical entries. All of those sit under the 2026-11-05 level, which is why a phone showing only the November 1 patch is not fully protected.
The "SMS of Death" bug
One flaw has drawn more attention than the rest. CVE-2026-58882 is a critical denial of service bug in which a specially crafted SMS can crash the calling service, which can interrupt calls, including emergency calls. It affects Android 14 through 17, according to Techlicious.
Researcher Mark Blaszczyk disclosed the bug publicly on October 29 after reporting it in May, and Techlicious says public exploit code exists, though it found no malicious campaign and no identified victims. eSecurity Planet says Google had a fix available in October, and the bug also appears in the November bulletin. The 2026-11-01 patch level covers it.
Who gets the fix and when
Pixel owners can check for the update under system settings. Rollout was uneven in the first days. Techlicious wrote on November 3 that its Pixel 10 Pro XL still showed an October 5 patch, while a German outlet, Schmidt's Blog, reported the same day that Google had begun distributing the November update. Neither source gave a Pixel schedule, and Google has not published one that we could find.
Samsung's November package covers 206 vulnerabilities, made up of 178 Android fixes, four Samsung Semiconductor fixes and 24 Samsung-specific fixes, according to eSecurity Planet. Samsung has not published a firm rollout schedule, and availability will vary by device, carrier and region. Other makers follow their own timelines, so some phones will receive the fixes later than Pixels.
What Indian users should check
The bulletin is global, and Google has not announced anything India specific. Indian users on phones from Samsung, Xiaomi, Oppo, Vivo and others should open the security update page in settings and read the patch date, because a phone that says it is up to date may still be on a September or October level. If the date is earlier than November 1, the three remote code execution fixes are not yet on the phone. If it reads November 1 but not November 5, the kernel and chip fixes are still missing.
What to watch next
Watch for the Pixel rollout to reach all supported models, and for Samsung to confirm the order in which it will update the Galaxy range. Google has also said it will publish the matching AOSP source patches within 48 hours of the bulletin and add links to it, which will let custom ROM developers apply the fixes. Any report of attacks using the Framework flaw would raise the urgency, so it is worth checking your own patch date this week.
Published 6 November 2026. Gadgets365 will update this article as more information becomes available.
