Google has rolled out its Android security update for November 2026, covering more than 200 vulnerabilities across platform, kernel, and hardware elements. The update includes several critical remote code execution (RCE) flaws that can be triggered without any user interaction — so-called zero-click flaws — making them especially dangerous. Devices bearing the security patch level “2026-11-05” or later will receive all relevant fixes.
Zero-Click Critical Risks and Key Vulnerabilities
The most severe vulnerability is Framework flaw CVE-2026-58868, which enables remote code execution on Android versions 14, 15, 16, 16 QPR2, and 17 — without any elevated privileges or user actions. Two other grave RCE flaws, CVE-2026-58876 and CVE-2026-58936, affect the System component of those same releases, and likewise demand no user interaction and no additional privileges. However, Google hasn’t provided full technical detail on how these zero-click vulnerabilities might be delivered or triggered.
Besides these RCE patch-ups, the bulletin closes off other high-severity bugs tied to information disclosure, privilege escalation, and denial-of-service (DoS) defects. One notable non-RCE flaw, CVE-2026-58988 in Android runtime, could expose sensitive data without user interaction or extra privileges. Framework and System fixes also cover scenarios enabling attackers to break protections, leak data, or disturb device operations depending on specific flaws present.
Hardware and Kernel Fixes Across Multiple OEMs
The kernel updates for November include urgent corrections in Bluetooth, Human Interface Device (HID) support, and virtual machine components. One of the top kernel flaws could allow remote privilege escalation without user action or higher permissions. Hardware fixes span chips made by Arm, MediaTek, Unisoc, Qualcomm, and Imagination Technologies. MediaTek alone has eight critical modem vulnerabilities addressed; Qualcomm’s closed-source components contain at least one critical flaw. Exposure depends heavily on the individual device’s hardware and how thoroughly the manufacturer implements the patches.
The update splits fixes between patch levels “2026-11-01” and “2026-11-05.” The latter encompasses all new patches plus some from previously released bulletins. End users are urged to apply any software updates from their device makers and also check for Google Play system updates. Meanwhile, Pixel users have official guidance on how to check for updates — though carrier or model differences may delay delivery.
Although these vulnerabilities are serious, there’s no indication they’ve been exploited yet. The reportage emphasizes that ‘‘zero-click’’ describes the exploit’s possible interaction model — not confirmation of ongoing attacks. Users should not assume present use, but vigilant updating remains the safeguard.
Why it matters: as Android devices grow more complex, the hardware-software attack surface widens. Zero-click vulnerabilities are particularly stealthy, leaving almost no trace or opportunity for defensive action before compromise. By aggressively patching these kinds of weaknesses, Google is pushing both device makers and users toward tightening security hygiene. What to watch next: OEMs’ patch rollout speed, whether any of the newly fixed flaws start seeing in-the-wild exploitation, and how manufacturers educate users about checking patch dates, not just Android versions.
