Google fixes 216 Android flaws in November security update

Google’s November 2026 Android Security Bulletin fixes 216 vulnerabilities across two patch levels, according to the November 2026 update. The most serious issue is a critical Framework flaw that enables remote code execution with no user interaction. The bulletin notes 23 critical bugs in total, spanning the Framework, System, kernel and chipset components.

The 2026-11-05 patch level covers the bulk of kernel, Arm, Imagination, MediaTek, Unisoc and Qualcomm fixes, while the 2026-11-01 list includes 119 flaws in Framework, System and Android runtime. The bulletin says there were no confirmed exploits in the wild at the time of reporting, and CVE Watchtower likewise lists several entries as not known to be exploited.

Notable CVEs tied to this month’s fixes include CVE-2026-58868, a FrameDecoder.cpp heap buffer overflow that can cause an out-of-bounds write; CVE-2026-58936, a use-after-free in libpng’s png_set_tRNS handling; and CVE-2026-58876, a use-after-free in Media Codecs delivered via Google Play system updates. Other high‑severity entries include CVE-2026-55275 and CVE-2026-55283 (both privilege escalation in System) and CVE-2026-58984 (System).

CVE-2026-53256 (Bluetooth in the kernel) and CVE-2026-89774 (Bluetooth in the kernel) are also listed as critical, with CVSSv3 scores reaching 8.8 for CVE-2026-89774. Affected Android versions span 14, 15, 16, 16 QPR2 and 17, with some fixes specific to newer builds (for example, CVE-2026-55275 affecting Android 16 and later).

The guidance from Google is to install the latest updates and verify a patch level of 2026-11-05 or newer; patches from Media Codec, MediaProvider, WiFi and Telephony are also delivered via Google Play system updates.