Google published the Android Security Bulletin for November 2026 on 2 November. It addresses 216 vulnerabilities, of which 23 are rated Critical and the remainder High.
The headline entry is CVE-2026-58868, a flaw in the Framework component affecting Android 14, 15, 16, 16 QPR2 and 17. Google's description is short and alarming: "User interaction is not needed for exploitation."
Three details are widely getting lost, and each matters practically.
It is not one flaw, it is three. Alongside CVE-2026-58868 in Framework, the bulletin fixes CVE-2026-58876 and CVE-2026-58936 in the System component. All three are rated critical remote code execution requiring no user interaction.
The bulletin went out on 2 November, not 4 November.
Patch level 2026-11-01 is not the finish line. It fixes CVE-2026-58868. Google states that security patch levels of 2026-11-05 or later address all of these issues. A phone showing 2026-11-01 has the Framework fix and is still missing the rest of the month's work.
As of 4 November, Google had reported no active exploitation of these flaws.
What happened
The three zero-interaction flaws
CVE | Component | Effect |
|---|---|---|
CVE-2026-58868 | Framework | Remote code execution, no additional privileges, no user interaction |
CVE-2026-58876 | System | Remote code execution, no additional privileges, no user interaction |
CVE-2026-58936 | System | Remote code execution, no additional privileges, no user interaction |
The CVE record for CVE-2026-58868 describes it as a possible out-of-bounds write in onOutputReceived of FrameDecoder.cpp. That is a media decoding path, which is consistent with a zero-interaction flaw: content gets parsed before a user does anything with it.
Worth noting on severity scoring: Google uses its own Critical, High and Moderate ratings rather than CVSS. As of 4 November, all three CVEs were listed as "Awaiting Analysis" with no CVSS score from either NVD or the CNA. Any CVSS figure attached to these in circulation is not yet authoritative.
What else is in the bulletin
The 216 fixes span Framework, System, Android runtime, the Linux kernel, Bluetooth, Wi-Fi and closed-source components from Qualcomm, MediaTek and Unisoc. Framework received the largest number of fixes at 65, followed by System at 53.
The bulletin also formally documents the "SMS of Death" vulnerability, which can silently disconnect calls. One caveat worth carrying: the researcher says Google's fix shipped in October, so its appearance in the November bulletin should not be read as evidence that every previously updated device was vulnerable until now.
The patch level problem
This is the part most coverage gets wrong, and it has direct consequences for anyone managing devices.
Android bulletins use two patch levels each month:
2026-11-01 covers the first group of fixes, including CVE-2026-58868
2026-11-05 covers everything, including the remaining System and vendor component fixes
Telling people to install 2026-11-01 "immediately" is correct as far as it goes. It is also incomplete, because the two other zero-click System flaws are not in that group.
Why you may be waiting on your manufacturer
Google rolled out 17 of this month's fixes ahead of the monthly cycle through Google Play system updates, which arrive without a full firmware update.
But CVE-2026-58868 and CVE-2026-58936 are not on that list. Those two depend on the manufacturer's own update, which is the slower path and the one that varies wildly between vendors and carriers.
In practice that means a phone can be fully current on Play system updates and still be exposed to the worst flaw in the bulletin.
Why it matters
Zero interaction removes the user from the defence. Most mobile security advice tells people what not to tap. None of that applies here. There is no suspicious link to avoid, no attachment to leave unopened and no permission prompt to decline. The only variable is whether the device has the patch.
The media decoding path is a recurring weak point. A flaw in frame decoding means malicious content can be processed before anyone chooses to view it. This class of bug has historically been attractive for targeted attacks precisely because the delivery can be made invisible.
Patch distribution is the real vulnerability. Google shipped fixes on 2 November. Whether your phone receives them depends on the manufacturer, the carrier, the model's age and the region. For two of the three critical flaws, Google Play system updates cannot help.
No active exploitation is a status, not a guarantee. Google reported none as of 4 November. Public disclosure of a zero-click RCE tends to shorten the interval before someone builds an exploit, and that interval has been compressing across the industry.
Corporate fleets have a scoping problem. Android 14 through 17 covers an enormous installed base. Any organisation with a bring-your-own-device policy now has an exposure it cannot measure without checking each device's patch level individually.
Who is affected
Devices running Android 14, 15, 16, 16 QPR2 and 17 below the November patch level.
Phones from manufacturers slow to ship monthly updates, which is where the longest exposure sits.
Older and budget devices, which may never receive these fixes.
Organisations with bring-your-own-device or loosely managed mobile fleets.
Anyone on 2026-11-01 but not 2026-11-05, who still lacks fixes for two of the three zero-click flaws.
Devices with Qualcomm, MediaTek or Unisoc components, covered by the vendor sections of the bulletin, including one critical Qualcomm closed-source flaw.
What to do
For individuals
Check your security patch level. Open Settings, then Security, and look for the security patch level entry. Exact wording varies by manufacturer.
Install any available update. If your device offers 2026-11-05 or later, take it. If it only offers 2026-11-01, take that and check again in the following weeks.
Check Google Play system updates separately, under Settings, Security, Google Play system update. These arrive independently of firmware, though they do not cover the worst flaw here.
If your device no longer receives updates, treat that as a decision point. A phone that will never get this fix is permanently exposed to a zero-click remote code execution flaw.
For organisations managing devices
Report on patch level, not on OS version. Android 17 tells you nothing about whether this is fixed. The patch level string is the only thing that does.
Set a target of 2026-11-05 or later, not 2026-11-01, and treat anything below as outstanding.
Identify devices that cannot reach that level, and plan replacement or restriction of access for them.
Press manufacturers and carriers on timelines. For CVE-2026-58868 and CVE-2026-58936, their update is the only route.
Expect a long tail. Monthly Android patches reach the full fleet over weeks, not days, and some devices never arrive.
Do not rely on user awareness training here. There is no user behaviour to correct when exploitation requires no interaction.
Final thoughts
Two hundred and sixteen fixes, twenty-three critical, and three that let an attacker run code on a phone whose owner did nothing at all. The flaw sits in a frame decoder, which means hostile content can be processed before any human decides to engage with it.
The lesson: for zero-interaction flaws, patch distribution is the entire security model. There is no second line here. No training module, no cautious user behaviour and no email filter changes the outcome. Either the device has the fix or it does not, and whether it does depends on a supply chain running from Google through a chip vendor, a handset manufacturer and often a carrier before it reaches the phone in someone's pocket.
The second lesson is specific and easy to get wrong. Patch level 2026-11-01 fixes the headline flaw and leaves two other zero-click remote code execution bugs unaddressed. The level that closes the month is 2026-11-05. Advice telling people to install 2026-11-01 and stop is advice that leaves two of three critical flaws open.
Two things worth doing today: check your own patch level in Settings, and if you manage a fleet, pull a report on patch levels rather than OS versions.
