Google published the November 2026 Android Security Bulletin on November 2 and updated its issue list on November 6. Google does not print totals, but tallying the bulletin’s tables gives about 215 unique vulnerabilities across two patch levels, 2026-11-01 and 2026-11-05, with 23 rated Critical. Three of the Critical flaws are remote code execution bugs in the Framework and System components. The bulletin does not say any issue is under limited or targeted exploitation. For scale, the October bulletin we covered fixed 25 flaws.
What the Critical Flaws Are
The 2026-11-01 patch level carries eight Critical issues, all in the Framework or System. The three remote code execution bugs are CVE-2026-58868 in the Framework, and CVE-2026-58876 and CVE-2026-58936 in System, each listed against Android 14 through 17. System also holds three Critical privilege escalation bugs (CVE-2026-55275, CVE-2026-55283, and CVE-2026-58984) and two denial of service bugs (CVE-2026-58814 and CVE-2026-58882).
The 2026-11-05 level adds 15 more Critical entries, all in kernel and chip-vendor code. Six are in the Kernel section: Bluetooth privilege escalation bugs CVE-2026-53256 and CVE-2026-89774, pKVM privilege escalation bugs CVE-2026-59044 and CVE-2026-59045, HID privilege escalation bug CVE-2026-80604, and a pKVM information disclosure bug, CVE-2026-59048. Eight are MediaTek modem issues (CVE-2026-20499, CVE-2026-20519, CVE-2026-20520, and CVE-2026-20545 through CVE-2026-20549), and one is in a closed-source Qualcomm component (CVE-2026-25285). The bulletin states that the most severe vulnerability in the Kernel section could lead to remote escalation of privilege, and it gives no vulnerability type for the MediaTek and Qualcomm closed-source entries.
Why There Are Two Patch Levels
Google splits the bulletin so that device makers can ship a subset of fixes faster. The 2026-11-01 level covers the Android runtime, Framework, System, and the Google Play system updates. The 2026-11-05 level covers the Kernel, Arm, Imagination Technologies, MediaTek, Unisoc, and Qualcomm components. A device reporting 2026-11-05 or later has everything in both levels, while a device stuck at 2026-11-01 has the Framework and System fixes but not the kernel and chip-vendor ones. Manufacturers record this in the ro.build.version.security_patch property, so check that value rather than assuming “November” means fully patched.
Who Should Actually Care
None of this is fixed by an app update. The Framework and System patches arrive through the OS update on whatever schedule each manufacturer follows, which means plenty of users will sit on an older patch level for weeks. Teams that run their own test device pools, or that support managed fleets such as kiosks, scanners, or field-service handhelds, should know which patch level each device is on. The bulletin also lists Google Play system updates for Media Codecs, MediaProvider, Profiling, Telephonycore, and WiFi, and says devices on Android 10 or later may receive them, so apps that depend on media playback or connectivity behavior are worth a quick regression pass after those land.
What To Do Now
- Record the security patch level of every device in your test pool and managed fleet, and flag anything below 2026-11-05.
- If your app leans on media codecs, WiFi handling, or telephony, re-test those flows once the Google Play system updates reach your test devices.
- Don’t ship an emergency app release over this bulletin. Nothing in it is reported as exploited, and the fixes are OS-side.
If you maintain an Android app and haven’t checked it against recent patch levels, a compatibility pass is a short audit, not a rebuild. Our mobile app development team does this kind of review, and we covered the lighter October cycle in Android’s October 2026 Patch Fixes 25 Flaws, Seven of Them Critical.
Sources
- Android Security Bulletin, November 2026 (source.android.com, published November 2, 2026, updated November 6, 2026)
