-11.png?w=640)
Your Pixel’s security patch date deserves as much attention as its new features.
Google began rolling out Android 17 QPR2 to supported Pixel devices on Nov. 10, bringing November security patches and 33 functional fixes. The release arrived about a month earlier than expected, alongside the November Pixel Feature Drop, according to 9to5Google.
For businesses managing Android phones, the priority is confirming which devices have received the fixes. Other manufacturers follow their own update schedules, so Pixel availability does not establish whether the rest of a company’s Android fleet is protected.
Android and Pixel bulletins cover separate sets of flaws
Google’s November Android security bulletin lists 215 distinct vulnerabilities: 118 under the Nov. 1 patch level and another 97 under Nov. 5. These comprise 23 critical and 192 high-severity vulnerabilities across Android software, the kernel, and hardware vendor components.
The separate November Pixel bulletin lists 166 additional vulnerabilities affecting Google devices, including moderate-, high-, and critical-severity issues.
Among the critical flaws, CVE-2026-58868 affects Android Framework and could allow remote code execution (RCE) without additional execution privileges or user interaction. Another, CVE-2026-55275, is an elevation-of-privilege (EoP) vulnerability affecting Android System, which could allow an attacker to gain permissions beyond those normally available to them.
The bulletin also identifies high-severity information-disclosure flaws, including CVE-2026-58988 in Android Runtime. Exploiting this vulnerability could expose locally stored information without requiring additional execution privileges or user interaction.
Google has addressed these and the other reported vulnerabilities through its November security updates.
Beyond security: Pixel users get a few extras
Alongside the security patches, Android 17 QPR2 brings feature changes and functional fixes to supported Pixel devices.
Pixel fixes address notification snoozing, the notification shade, theme colors, and notification readability. The update also resolves audio and volume bugs.
For users concerned about the privacy implications of AI, Android 17 QPR2 adds Private Compute Core logging under Settings > Security & privacy > Privacy dashboard > Data logging. Private Compute Core itself dates to 2021; the addition gives users visibility into an existing privacy component.
Other changes add stability to features including charging, Bluetooth, cameras, app switching, sensors, and general system performance.
Who gets Android 17 QPR2 and when?
Google began rolling out Android 17 QPR2 to supported Pixel devices on Nov. 10, alongside the November security patch and Pixel Feature Drop. The rollout is starting early, about a month ahead of its expected schedule, but that doesn't mean every eligible phone will receive the update at the same time.
Here are the supported devices:
| Device group | Eligible models |
|---|---|
| Pixel 6 | Pixel 6a |
| Pixel 7 | Pixel 7, 7 Pro, 7a |
| Pixel 8 | Pixel 8, 8 Pro, 8a |
| Pixel 9 | Pixel 9, 9 Pro, 9 Pro XL, 9 Pro Fold, 9a |
| Pixel 10 | Pixel 10, 10 Pro, 10 Pro XL, 10 Pro Fold, 10a |
| Pixel 11 | Pixel 11, 11 Pro, 11 Pro XL, 11 Pro Fold |
| Other Pixel devices | Pixel Tablet, Pixel Fold |
You can check for the update by going to Settings > System > System update and selecting Check for update. If it hasn't appeared yet, give Google some time to complete the staged rollout.
If you are running the Android 17 QPR2 beta, review Google’s instructions for leaving the Beta Program before opting out. Google provides a limited window to move to the matching stable release without wiping data. Outside that window, returning to stable can erase locally saved data. Back up the device and read the update notice before proceeding.
Verify patch installation across work devices
For eligible Pixels, check that the Android security patch level shows Nov. 5, 2026, or later after installation. Google identifies that level as covering both November bulletins on supported Pixel devices.
For security teams, an available update should trigger a deployment check:
- Confirm installation: Record each device’s model, software build, and Android security patch level.
- Track exceptions: Identify phones awaiting the rollout, devices with failed installations, and users who have postponed restarting.
- Assign follow-up: Give outstanding devices an owner and a date for another check.
- Check support status: If a phone no longer receives security updates, assess replacement or access restrictions under the organization’s security policy.
For other Android brands, consult the manufacturer’s bulletin and model-specific rollout information. A quarterly platform release and a monthly security update can follow different schedules, so check the security patch level even if the phone has not received equivalent Pixel features.
Automatic updates can help, but security teams should still verify that installation completed. Keep unresolved devices visible in the patch-management process until their status is confirmed.
Read more: For Galaxy devices in a mixed Android fleet, Samsung’s November security update explains the vendor-specific flaws and patch details owners should check.