Android’s November 2026 Updates Patch Over 200 Vulnerabilities

Google has released its November 2026 Android security bulletin, closing more than 200 vulnerabilities, two dozen of which are rated critical. The first patch level, 2026-11-01, covers 119 flaws in Android runtime, Framework and System, with Framework accounting for 65 fixes and System for 53. The worst of these, CVE-2026-58868, sits in the Framework component and could let an attacker achieve remote code execution without needing elevated privileges or any action from the victim. A second batch, patch level 2026-11-05, addresses 97 additional issues spanning Kernel, Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm code, including over a dozen critical bugs in Bluetooth, pKVM, HID, the MediaTek modem and a closed-source Qualcomm module. Google also issued parallel bulletins for Android XR and Wear OS, each carrying a handful of extra high-severity Framework and System fixes, and urges all device makers and users to move to the latest patch levels as soon as possible.