Install Android's November update: it fixes a critical no-click flaw
Google's November bulletin fixes a critical Framework bug that could allow remote code execution with no user interaction.
The skim
- What to do: install the November Android update when it's offered. Open Settings > System > Software updates (on Pixel) and check that your Android security update says Nov. 1 or Nov. 5, 2026 or later.
- Google's November bulletin fixes a critical flaw in Android's Framework that could allow remote code execution with no user interaction (CVE-2026-58868). It affects Android 14 through 17.
- In all, SecurityWeek counts more than 200 fixes across the two patch levels: 119 in the Nov. 1 level and 97 in the Nov. 5 level.
What to do
- Open Settings > About phone > Android version and look at "Android security update." If it reads 2026-11-05, you're covered. 2026-11-01 covers the Framework and System fixes but not the kernel and chip-maker fixes.
- If it's older, go to Settings > System > Software updates and follow the prompts. Google recommends being on Wi-Fi with at least 75% battery.
- Restart if asked. On Pixels, installed updates become active the next time you restart.
Step-by-step with fixes for stuck updates: How to check your Android security update.
What Google fixed
The Android Security Bulletin for November 2026, published Nov. 2, calls the Framework bug the most severe of the month: "a critical security vulnerability in the Framework component that could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation." Google lists it as affecting Android 14, 15, 16 and 17.
The bulletin splits fixes into two patch levels. The 2026-11-01 level covers the Android runtime, Framework and System. The 2026-11-05 level adds kernel and chip-maker components such as Arm, MediaTek, Unisoc and Qualcomm, SecurityWeek reports. heise online also notes two critical System flaws that could be exploited with no user interaction.
The bulletin doesn't describe how an attack would work, and we haven't seen a report of attacks in the wild.
When you'll get it
Pixels get updates the day the bulletin is released, though Google says it takes about a week and a half to reach every device. Other brands and carriers follow their own schedules, so a Samsung or Motorola phone may show the patch later. If you're on an older phone that no longer gets updates, switching to a supported model is the only full fix.
Sources: Android Security Bulletin, November 2026, SecurityWeek, heise online, Android Help.
