Android’s November Update Fixes a Zero-Click Flaw in Android 14 to 17. Here’s How to Get It

Google’s November Android security bulletin is out, and it’s a big one. The bulletin, dated November 1, 2026, lists 216 vulnerabilities, 23 of them rated Critical. The one that matters most is CVE-2026-58868, a bug in Android’s media framework that Google says could let an attacker run code on your phone remotely with no action on your part. No tap, no download, no suspicious link.

It affects phones running Android 14, 15, 16 and 17. That covers nearly every Android phone sold in the U.S. over the last three years.

The good news: as of November 4, nobody has reported attacks using it, and it isn’t on CISA’s Known Exploited Vulnerabilities list. The bad news is that zero-click bugs are exactly what spyware vendors go shopping for, and the window between a public patch and working exploits keeps getting shorter. This is a “check your phone tonight” update, not a “whenever” one.

What the November 2026 Android update fixes

CVE-2026-58868 lives in FrameDecoder.cpp, the code Android uses to pull frames out of video and image files. According to The Hacker News, a heap buffer overflow in its onOutputReceived function can produce an out-of-bounds write, the classic setup for remote code execution. Media parsers have a long, ugly history here because phones decode files automatically, often before you’ve even opened them.

It isn’t alone. The bulletin includes:

• Two more Critical remote code execution bugs in the System component, CVE-2026-58876 and CVE-2026-58936. Techlicious counts three zero-interaction RCE flaws in total.
• CVE-2026-58882, a Critical remote denial-of-service bug in decodeWapPdu, the code that handles WAP Push messages over SMS. It sits in the same function as the “SMS of Death” crash a researcher published on October 29, though Google hasn’t said whether they’re the same bug.
• Six Critical kernel flaws, two of them in Bluetooth.
• Critical chip-level fixes for MediaTek modems and a closed-source Qualcomm component.

One caveat worth keeping in perspective: Google’s Critical rating assumes Android’s built-in mitigations are disabled or bypassed. Real-world exploitation is harder than the label suggests. It’s still not a bet worth making with the phone that holds your bank app.

Outlets are tallying the bulletin slightly differently. GoogleWatchBlog counts 24 Critical and 193 High issues, while The Hacker News reports 216 total with 23 Critical. The difference comes down to how vendor entries are counted, and it doesn’t change the advice.

The two patch levels, and why the date matters

Google splits each month’s fixes into two security patch levels, and this month the difference is meaningful:

• 2026-11-01 or later covers CVE-2026-58868, the other two RCE bugs and the SMS crash, all in Android’s Framework and System code.
• 2026-11-05 or later covers everything in the bulletin, including the kernel and the chipset fixes from Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm.

Some fixes also arrive through Google Play system updates on Android 10 and up, including CVE-2026-58876. CVE-2026-58868 is not one of them. You need the actual firmware update from your phone maker, so a fresh Play system update date alone won’t protect you from the headline bug.

How to check your phone and install the update

1. Pixel: Open Settings > System > Software updates > System update and tap “Check for update.” As of Wednesday morning, reports from Techlicious and GoogleWatchBlog said the November Pixel build hadn’t landed yet; Google typically ships it within the first week of the month.
2. Samsung Galaxy: Go to Settings > Software update > Download and install. Samsung published its November bulletin on November 3, and after installing you should see “SMR Nov-2026 Release 1” under Security software version. Timing varies by model and carrier, and some chip fixes may come in a later update.
3. Everyone else: Look for the security update date under Settings > Security & privacy > System & updates, or Settings > About phone > Android version. You want November 1 at minimum, November 5 ideally.

Carrier-locked phones from Verizon, AT&T and T-Mobile often lag unlocked models by a week or two. If you’re on a carrier model and nothing shows up, check again this weekend.

Pixel 6 owners: this is the month the clock ran out

The uncomfortable part of this bulletin is who doesn’t get it. The Pixel 6 and Pixel 6 Pro reached end of support with the October 2026 update, so they’ll sit at the October patch level with CVE-2026-58868 unpatched. Play system updates will cover some components, but as Schmidtis Blog points out, kernel, modem and memory-controller bugs need firmware patches that these phones will never receive.

Android 12 and 13 phones are in a similar spot. The SMS of Death researcher says those versions run the vulnerable WAP Push code but won’t get the fix.

Here’s where the older Pixels stand:

Pixel 9, 10 and 11 models get seven years from launch, so they’re nowhere near the cutoff.

Our take

A zero-click bug in a media decoder, across four Android versions, is about as serious as monthly patches get without an active attack attached. Install the update the moment it appears. If you’re still on a Pixel 6, a Pixel 6 Pro or anything stuck on Android 12 or 13, and that phone handles your banking, two-factor codes or work email, this is the month to start shopping. A refurbished Pixel 8 or Pixel 9 buys you years of patches for a few hundred dollars, and that’s cheaper than cleaning up a compromised account.

Sources: The Hacker News, Techlicious, GoogleWatchBlog, Schmidtis Blog. Photo by Denny Müller on Unsplash.