Google published the Android Security Bulletin for November 2026 on 2 November 2026. It lists 208 vulnerabilities across two security patch levels: 113 at 2026-11-01 (Android runtime, Framework and System) and 95 at 2026-11-05 (kernel components and Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm components), and says devices on patch level 2026-11-05 or later are protected against all of them.

Google says the most severe is a Critical flaw in the Framework component that could lead to remote code execution with no additional execution privileges and no user interaction; that entry is CVE-2026-58868 (Android 14 to 17). Of the 208, 23 are rated Critical: at 2026-11-01, CVE-2026-58868 (Framework, remote code execution) and, in System, CVE-2026-58876 and CVE-2026-58936 (remote code execution), CVE-2026-55275, CVE-2026-55283 and CVE-2026-58984 (privilege escalation) and CVE-2026-58814 and CVE-2026-58882 (denial of service); at 2026-11-05, six upstream Linux kernel flaws in Bluetooth (CVE-2026-53256, CVE-2026-89774), pKVM (CVE-2026-59044, CVE-2026-59045, CVE-2026-59048) and HID (CVE-2026-80604), eight MediaTek modem flaws (CVE-2026-20499, CVE-2026-20519, CVE-2026-20520, CVE-2026-20545 to CVE-2026-20549) and one Qualcomm closed-source flaw (CVE-2026-25285).

Google says the most severe kernel-component issue could lead to remote escalation of privilege with no user interaction. Some fixes also ship as Google Play system updates (Media Codecs, MediaProvider, Profiling, Telephonycore and Wi-Fi).

The bulletin does not flag any of these as exploited, and Google says AOSP source patches follow within 48 hours of publication. (source: Android Security Bulletin)