On November 2, 2026, Google published the Android Security Bulletin for November. It fixes 216 vulnerabilities, 23 of them critical and 193 high. The worst is a flaw in the Framework component that lets an attacker run code on a phone remotely, with no tap from its owner and no extra privileges. What you need to do today is simple: ask every employee who opens company email, WhatsApp Business or a banking app on an Android phone to install the update, then check that the «Android security update» date in Settings reads November 5, 2026 or later. A phone running Android 13 or older will not get this fix, because the bulletin covers versions 14 to 17 only.
What exactly did Google fix?
According to the Android Security Bulletin for November 2026, the fixes come in two levels. The November 1 level covers 119 vulnerabilities, 8 of them critical, in core parts of the system such as Framework, System and the runtime. The November 5 level covers 97 vulnerabilities, 15 of them critical, in the Linux kernel (31 flaws) and in chipmaker components: MediaTek (30), Qualcomm (17 across open and closed-source parts), Imagination (12), Unisoc (4) and Arm (3). A phone on the November 5 level is protected against the flaws in both levels.
Google says the most severe flaw (CVE-2026-58868) could lead to remote code execution with no additional execution privileges needed and no user interaction. The System section holds two more critical flaws of the same type (CVE-2026-58876 and CVE-2026-58936), plus three critical privilege-escalation flaws.
One message that drops the call: the WAP Push flaw
Among the critical flaws is a denial-of-service bug (CVE-2026-58882). CyberInsider's report explains that a single malformed WAP Push message is enough to crash Android's phone process, ending active calls, emergency calls included, without the message ever showing in the inbox or the recipient opening anything. Worse, repeated messages can bring the crash back even after a restart. The reassuring part: the report found no exploitation in the wild so far. But proof-of-concept code is public, which means the gap between disclosure and attacks may be short.
Picture a sales rep or delivery driver who lives on their phone all day, and whose calls drop every time a message they never see arrives. That is not a data breach, but it is work stopping.
When does the update reach Samsung phones?
Samsung published its November 2026 Security Maintenance Release on November 3. It includes Google's fixes and four Samsung Semiconductor patches, and says it adds 24 Galaxy-specific items. But a published bulletin does not mean every device gets the update that day: it rolls out in waves by model and region, and some older models receive security updates every three months instead of every month. So do not settle for «did you update?». Ask for the date shown in Settings.
5 steps for your company's phones this week
- List the phones: every Android phone an employee uses to reach company email, systems or banking apps, whether it is a company phone or their own.
- Check the security date: according to Google's support page, you find it in Settings under «About phone» or «Security», labelled «Android security update». You want 2026-11-05 or later as soon as it is available for the model.
- Install the Google Play system update too: part of the November 1 fixes arrives through it, and it shows in the same settings with its own date.
- Treat old devices as a known risk: a phone stuck on Android 13 or older is outside this bulletin. Keep it away from sensitive company accounts and plan to replace it.
- Make the rule automatic: device management tools such as Microsoft Intune let you set a minimum security patch level, so an older device is blocked from email and systems until it updates.
Is your company's Android app affected?
These flaws are in the operating system itself, not in your app, so you do not need to change your code because of them. But your app runs on top of that system: if it shows customer data or takes payments, an unpatched phone weakens the protection you built. Some banking apps use the Play Integrity API to refuse unsafe devices, and sensitive business apps can do the same. And if you distribute an internal app outside the store, also read our article on Google restricting installs from outside the store.
The Origami view
Most breaches do not start with the company server. They start with an employee's device that holds their email, messages and passwords. The monthly update is free and takes minutes, but in a company where nobody follows it up, it does not happen on its own. Make checking the security date a fixed part of the start of every month, like reviewing the suspicious emails we covered in our article on phishing emails. When we build custom apps and systems, we add a device-integrity and OS-version check before showing any sensitive data. If you want a review of your team's devices or your app, contact us or see our services.
Sources
- Google — Android Security Bulletin, November 2026: number of vulnerabilities, patch levels, affected components and Android versions 14 to 17.
- Samsung — Mobile Security Updates (SMR Nov-2026): publication date, Samsung Semiconductor patches and Galaxy items.
- Google — Android Help: Check and update your Android version: where the security update date sits in Settings.
- CyberInsider — Android November update and the WAP Push flaw: how CVE-2026-58882 works and the public proof of concept.
Frequently asked questions
How do I know my Android phone has the November 2026 update?
Open Settings, then «About phone» or «Security», and look for «Android security update». If the date is November 5, 2026 or later, the phone is protected against every flaw in the November bulletin; if it is November 1, it is protected against only part of them.
Does the November update reach a phone running Android 13?
No. Google's November 2026 bulletin covers Android 14, 15, 16 and 17 only. A phone stuck on Android 13 or older stays exposed, so keep it away from sensitive company accounts and plan to replace it.
Have attackers actually exploited these flaws?
Google's bulletin does not mention any exploitation in the wild, and CyberInsider's report found none for the WAP Push flaw. But proof-of-concept code for that flaw is public, so it is better to update this week rather than wait.
Do I need to change my company's Android app because of these flaws?
No, the flaws are in the operating system, not your app. But if your app shows sensitive data or takes payments, you can add a device-integrity check through Play Integrity to refuse unsafe devices.
