Google's November Android security update addresses 216 vulnerabilities, including a critical flaw that could allow attackers to execute malicious code without any user interaction.
The fixes include approximately two dozen critical-severity flaws, covering remote code execution (RCE), privilege escalation, information disclosure, and denial-of-service attacks.
The first batch, identified by the Nov. 1, 2026, security patch level, resolves 119 vulnerabilities across Android Framework, System and Runtime. Framework accounts for 65 fixes, while System receives 53. The remaining fix addresses an information disclosure vulnerability in Android Runtime.
“The most severe of these issues is a critical security vulnerability in the Framework component that could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation,” Google said in its security bulletin.
Two additional critical RCE vulnerabilities, CVE-2026-58876 and CVE-2026-58936, affect Android System.
The second batch, marked by the Nov. 5 security patch level, addresses another 97 vulnerabilities affecting the Linux kernel and components from Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm.
More than a dozen of these fixes address critical vulnerabilities involving Bluetooth, protected Kernel-based Virtual Machine (pKVM), human interface device (HID) components, MediaTek modems and a Qualcomm closed-source component.
The 'SMS of Death' also gets attention
Another notable vulnerability is CVE-2026-58882, a critical denial-of-service flaw nicknamed the "SMS of Death."
The vulnerability involves specially crafted SMS messages that can crash Android's calling service, potentially interrupting active calls, including emergency calls. eSecurity Planet previously reported that independent researcher Mark Blaszczyk disclosed the issue publicly on Oct. 29 after reporting it to Google in May.
Google previously indicated that a fix was available in October, although the vulnerability also appears in November's security bulletin. Its inclusion does not necessarily mean devices that received the earlier correction remained exposed, but users should confirm that their devices have received the applicable security updates.
Samsung prepares its own Galaxy security package
Samsung has also published details of its November security release, which combines Android fixes with additional protections for Galaxy devices.
According to SammyGuru, the package addresses 206 vulnerabilities, including 178 Android fixes from Google, four Samsung Semiconductor fixes and 24 vulnerabilities affecting Samsung's own software.
The Galaxy-specific fixes cover issues involving the bootloader, camera filter plugins, Samsung Contacts, Dialer, Messages and SIM lock protections. Some vulnerabilities could allow unauthorized calls, expose sensitive information or enable code execution under specific conditions. Samsung has not provided a firm rollout schedule. Availability will depend on device model, carrier and region, with updates expected to arrive in phases.
What the patch means for Android users
The biggest concern for consumers is that some of the vulnerabilities do not require them to open suspicious links, install malicious applications or approve unusual permissions before an attack could succeed.
The Framework RCE flaw is particularly concerning because of its zero-interaction attack requirements. Android users should check their security patch dates rather than assume that receiving a routine software update means every November vulnerability has been addressed.
The Nov. 1 patch level covers the Framework and System fixes, including the SMS vulnerability, while the Nov. 5 level covers all applicable vulnerabilities in Google's November bulletin.
Pixel owners should check Settings for available system updates. Samsung users can navigate to Settings, Software update, then Download and install. Other manufacturers may use different menu names and release schedules.
Patch delays remain a security problem for businesses
For businesses managing Android devices, the November release presents a significant patch management challenge.
Differences in manufacturers, hardware components, carriers, and regional rollout schedules can leave some devices exposed to known vulnerabilities even after Google publishes fixes.
Enterprise IT teams should verify the security patch levels of managed devices, prioritize updates for phones used to access corporate email and sensitive applications, and confirm that applicable vendor-specific fixes have been installed.
Organizations should also review mobile device management policies to identify unsupported devices and enforce minimum security patch requirements where possible.
The November release underscores why patch availability alone is not enough. Businesses need visibility into which devices have actually received the fixes and which remain vulnerable while waiting for updates.
In other security news, General Motors has agreed to a $220 million settlement with 36 US states over allegations that it collected and sold drivers' location and driving behavior data to third-party brokers without proper consent, potentially allowing insurers to use the information to adjust premiums.