Google's November 2026 Android security update fixes 216 vulnerabilities, 23 of them rated Critical, according to the Android Security Bulletin published Nov. 2. To be fully covered, your phone needs a security patch level of 2026-11-05 or later. Whether and when you get it depends on who made your phone and which carrier you use.

What is in the November Android security update

The bulletin counts 216 vulnerabilities across Android and its partner components:

  • ART: 1
  • Framework: 65
  • System: 53
  • Kernel: 31
  • Arm: 3
  • Imagination: 12
  • MediaTek: 30
  • Unisoc: 4
  • Qualcomm: 9
  • Qualcomm closed-source: 8

Of the 23 Critical flaws, Google lists 1 in Framework, 7 in System, 6 in the Kernel, 8 in MediaTek components and 1 in Qualcomm closed-source components. The Framework Critical flaw, CVE-2026-58868, is a remote code execution bug. Google says it needs no extra privileges and no user interaction. Two more System flaws, CVE-2026-58876 and CVE-2026-58936, are also rated Critical remote code execution bugs, and a Critical denial-of-service flaw, CVE-2026-58882, sits in System as well. All three are in the first patch level, 2026-11-01. The bulletin also lists 17 CVEs under Google Play system updates, which it says are included in Project Mainline components.

The bulletin does not note any limited, targeted exploitation. Affected versions are Android 14, 15, 16, 16-QPR2 and 17, and which versions a given flaw touches varies by entry.

Which Android security patch level to look for

Google publishes two Android security patch levels each month. The 2026-11-01 level covers the first batch of fixes: 119 in Android runtime, Framework and System. The 2026-11-05 level adds 97 more, in kernel and chip-maker components. The 2026-11-05 level includes all of those fixes plus the rest, and everything from earlier months. So 2026-11-05 is the one that matters: if your phone shows that date or later, it has every fix in this bulletin.

What to do: how to check your phone and update

Menu names differ between makers, but the steps are usually these:

  1. Open Settings and go to About phone. Look for the Android security update entry, which shows your patch level as a date. Some phones tuck this under Software information.
  2. Go back to Settings and open System update (on some phones it is under System or Software update).
  3. Tap the option to check for updates, then download and install anything offered, and restart if asked.

If the date reads 2026-11-05 or later, you are done. If it is older and no update is offered, nothing is wrong with your phone: Google releases the bulletin, but each maker and carrier decides when its own update ships. Google's bulletin does not give rollout dates for any phone, so we cannot say when yours will get it. If you are also checking other Android settings, see our Android 17 features worth turning on and the Android scam protections checklist.

What we do not know

  • Rollout dates: the bulletin gives none for any phone maker, carrier or Pixel model.
  • Pixel: Google's Pixel Update Bulletin for November was not yet published when we checked on Nov. 4; the newest one listed was October's. We do not know when Pixel phones get the 2026-11-05 level.
  • Exploitation: the bulletin does not note limited, targeted exploitation of any of these flaws, and we have not seen reports of attacks.