Android November 2026 bulletin: aim for patch level 2026-11-05

Google published the Android Security Bulletin for November 2026 on November 2, 2026. If you carry an Android phone or tablet, this is the monthly cue to install your manufacturer’s update and then read the security patch level date yourself.

You do not need every CVE table. You need your own device on 2026-11-01 or, better, 2026-11-05, then a Settings check that proves the update landed.

This bulletin also lists SMS of Death / CVE-2026-58882 as a Critical denial-of-service fix in the System table at the 2026-11-01 level, so either November date covers it. It is a different story from MediaTek’s November product bulletin (chipmaker firmware notes that still reach you through your phone brand). This page is about Google’s platform bulletin and the patch-level dates it defines.

What Google published

From Google’s November bulletin:

• Security patch levels of 2026-11-05 or later address all issues in the bulletin.
• The bulletin has two patch-level dates so manufacturers can ship a first wave sooner:
  • 2026-11-01 covers the issues listed under that date.
  • 2026-11-05 covers the 2026-11-05 set and everything earlier in this bulletin (and prior bulletins).
• The intro calls out a critical Framework vulnerability that could lead to remote code execution with no extra privileges needed and no user interaction required for exploitation. In the Framework table that Critical remote-code-execution item is CVE-2026-58868.
• The bulletin lists roughly 216 CVE IDs. SecurityWeek counts 119 issues at 2026-11-01 and 97 at 2026-11-05, with about two dozen rated critical.
• Google says Android partners were notified at least a month before publication.
• Source patches to AOSP were scheduled within about 48 hours after the bulletin went public.

The detailed tables group fixes under Android runtime, Framework, System, Kernel, and partner components (Arm, Imagination, MediaTek, Unisoc, Qualcomm, and others). System also lists Critical remote-code-execution and elevation-of-privilege items. You do not need the full ID list memorized. The actionable strings are the patch dates: 2026-11-01 and 2026-11-05.

Secondary coverage such as SecurityWeek’s November 3 write-up summarizes the same bulletin for a wider audience. Google’s page remains the source of truth for dates and CVE tables.

Why two dates matter on your phone

Manufacturers often ship the first date first. That is still progress. Prefer 2026-11-05 when your phone offers it, because Google says that level clears the whole November bulletin.

• 2026-11-01 or later: covers the 2026-11-01 issue set.
• 2026-11-05 or later: covers the full November bulletin.
• Still on October 2026 or older: you are behind for this cycle.

Pixel phones, Samsung phones, Motorola phones, and everyone else still depend on their own updater. Google’s bulletin is the standard. Your brand ships the package.

How to update and verify on your own phone

Exact menus vary. The habit does not.

1. Connect to Wi-Fi and plug in, or make sure the battery is well charged.
2. Open Settings and find system updates:
   • Pixel: Settings > System > Software updates > System update (wording can vary slightly).
   • Samsung Galaxy: Settings > Software update > Download and install.
   • Other brands: search Settings for “software update” or “system update.”
3. Download and install what is offered. Restart when asked.
4. After restart, open Settings > About phone (sometimes under System) and read the Android security update / security patch level date.
5. Aim for November 5, 2026 / 2026-11-05. November 1, 2026 / 2026-11-01 is the earlier November level if that is all your brand has shipped.
6. Repeat on every Android phone or tablet you use, including hand-me-down phones that still get updates.

If Settings says the system is up to date but the patch date is still October 2026, your manufacturer has not shipped November to that model or carrier yet. Check again in a few days. Do not sideload random “November security patch” ZIP files from forums.

Google Play system updates (Mainline) can also move on their own on some devices. Those help for some components. They are not a full substitute for the device security patch level string. Aim for both when your phone offers them.

Do this / don’t do that

Do

• Install the system update your phone offers, restart, and read the security patch level date yourself.
• Prefer 2026-11-05 when it appears. Accept 2026-11-01 as an interim step if that is all that is available.
• Update Chrome and other apps from Google Play separately. OS patches and app patches are different jobs.
• Help relatives find the patch-level screen. The date is the proof.

Don’t

• Do not assume “up to date” means you have November 2026 without reading the date.
• Do not flash unofficial firmware to force a bulletin early.
• Do not confuse this Google bulletin with MediaTek’s November chip bulletin or with the separate SMS of Death explainer, even though this bulletin includes that fix.
• Do not ignore a phone that stopped getting monthly patches years ago. That is a replacement problem.

Bottom line

Google’s November 2026 Android Security Bulletin (published November 2, 2026) sets November patch levels at 2026-11-01 and 2026-11-05, with 2026-11-05 clearing the full set. The bulletin highlights critical Framework remote-code-execution risk among a large Framework, System, Kernel, and partner fix list. On your own phone or tablet: install the manufacturer update when it appears, restart, and confirm Settings shows 2026-11-05 (or at least 2026-11-01).

Image: Official Android security artwork from android.com.