Android Security Update for November 2026 Fixes 216 Flaws, Including Zero-Click RCE Bugs

TL;DR

Google’s November 2026 Android Security Bulletin fixes 216 vulnerabilities across two patch levels. The worst is a critical Framework flaw that allows remote code execution with no user interaction. This Android security update also patches 22 other critical bugs in System, the kernel and chipset components.

Patch level 2026-11-05 fixes every issue in this month’s bulletin. Three critical bugs allow zero-click remote code execution on Android 14 through 17. Google has not reported any exploitation in the wild.

Notable CVEs

Why It Matters

Remote code execution bugs that need no clicks are the most valuable kind for attackers. A crafted media file or image could be enough to run code on a phone. Moreover, Google says the critical flaw needs “no additional execution privileges.”

The bulletin does not flag any issue as exploited. Unlike some past months, it marks no issue as under limited, targeted exploitation. CVE Watchtower likewise lists CVE-2026-58876 as not known to be exploited. No public proof-of-concept has been confirmed.

By the numbers

• Total fixes: 216
• Critical: 23
• Largest groups: 65 Framework bugs, 53 System bugs and 30 MediaTek bugs
• Bug types in Android itself: 62 privilege escalation, 33 information disclosure, 20 denial of service and 4 remote code execution

How the Attacks Work

Remote code execution flaws

The top bug, CVE-2026-58868, sits in FrameDecoder.cpp. According to its CVE record, a heap buffer overflow causes “a possible out-of-bounds write.” Next, CVE-2026-58936 is a use-after-free in libpng’s png_set_tRNS function, which handles PNG transparency data. Meanwhile, CVE-2026-58876 is a use-after-free in Media Codecs that Google ships through Google Play system updates.

Privilege escalation flaws

Three critical System bugs, CVE-2026-55275, CVE-2026-55283 and CVE-2026-58984, allow escalation of privilege. Google’s record for CVE-2026-55275 calls it a “remote escalation of privilege” caused by a race condition. In the kernel, Bluetooth bugs CVE-2026-53256 and CVE-2026-89774 rank critical, alongside three pKVM flaws and one HID flaw.

Chipset flaws

Vendors rated 9 of their own bugs critical. MediaTek accounts for eight modem flaws, while Qualcomm adds one closed-source issue. Imagination Technologies, Arm and Unisoc contributed high-severity GPU, CPU, modem and bootloader fixes.

Affected Versions

• Platform: Android 14, 15, 16, 16 QPR2 and 17
• 2026-11-01 patch level: 119 Framework, System and Android runtime flaws
• 2026-11-05 patch level: 97 kernel, Arm, Imagination, MediaTek, Unisoc and Qualcomm flaws

Some bugs reach only newer builds. For example, CVE-2026-55275 affects Android 16 and later.

Patch and Mitigation

Install the Android security update as soon as your phone maker offers it. Then check Settings for a patch level of 2026-11-05 or later. Google says it will publish the source patches to AOSP within 48 hours.

Several Media Codecs, MediaProvider, WiFi and Telephony fixes also arrive through Google Play system updates. Until your device gets the patch, avoid opening media files from unknown senders. Full details are in the November 2026 Android Security Bulletin.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.