Android November Update Fixes 216 Bugs, One Needs Zero Clicks

One of the 216 bugs Google patched this week in Android doesn't need you to click anything, open anything, or even unlock your phone. A single malformed file arriving on the device is enough.

The bug nobody has to fall for

Google's November 2026 Android Security Bulletin landed with its usual monthly rhythm, but the headline flaw stands out. Tracked as CVE-2026-58868, it's a memory-handling bug in Android's core Framework component — the layer that decodes media and handles system-level tasks on every phone running Android 14 through 17. Google rates it critical and says it can lead to remote code execution (RCE), engineer-speak for an attacker running their own instructions on your phone, with zero user interaction required. No tap, no link, no "are you sure?" dialog standing between you and a compromised device.

It wasn't alone. Two more critical remote-code-execution bugs showed up in Android's System component — CVE-2026-58876 and CVE-2026-58936 — both rooted in how the OS mishandles memory while processing things like images. There's also a fix for what researchers nicknamed the "SMS of Death": a flaw that could crash or hang a phone just by sending it a crafted text message. The patch for that one reportedly shipped quietly back in October, but it's only now formally documented in this bulletin.

The kernel and chipset mess

Google splits its monthly bulletin into two patch levels, and the second one — dated 2026-11-05 — is where things get messier for actual device makers. It covers six critical kernel-level flaws touching Bluetooth, human interface device (HID) handling, and a virtualization layer called pKVM that's supposed to isolate sensitive processes from the rest of the OS. Stacked on top of that are eight critical vulnerabilities in MediaTek's modem firmware and one in a closed-source Qualcomm component.

That chipset detail matters more than it might look. A large share of the budget and mid-range Android phones sold across India run MediaTek chipsets specifically because they keep device prices down — which means a meaningful chunk of the country's roughly 700-million-strong smartphone base is sitting on hardware carrying eight critical modem bugs until their manufacturer bothers to push a fix.

A security patch is only as good as the update it actually reaches — and in India's Android market, that gap between "patched" and "received" can run for months, if it closes at all.

That gap is the real story here, not the bug count. Google can publish a fix the same day every month without fail, but Android's patching chain runs through chipset vendors, phone manufacturers, and sometimes telecom carriers before it reaches a user's notification tray. On a flagship from Samsung or Google itself, that chain moves fast. On a sub-₹15,000 phone from a smaller brand, it often doesn't move at all — some devices never see a single post-sale security update. There's no CERT-In mandate in India that forces manufacturers to keep pushing patches on a fixed timeline, unlike some EU proposals currently being debated for IoT and connected devices.

What you can actually do about it

None of the critical bugs in this bulletin are listed as actively exploited in the wild yet, and none appear on CISA's Known Exploited Vulnerabilities catalog as of early November. That's the good news — researchers found these before attackers weaponized them. But "not yet exploited" has a short shelf life once a bulletin is public, because it tells attackers exactly where to start looking.

• Go to Settings → Security → System update and check your patch level is 2026-11-01 or later (ideally 2026-11-05, which covers the kernel and chipset fixes too)
• If your phone shows no update available, check whether your specific model is still on your manufacturer's support list — plenty of budget devices quietly age out within two years of launch
• Avoid sideloading apps from unknown sources in the meantime, since Google's own recent crackdown on unverified sideloaded apps exists precisely because that's the easiest way these kinds of flaws get chained into real attacks

The uncomfortable truth is that the strongest patch Google can write still depends on a supply chain it doesn't fully control. Until manufacturers — especially the ones selling the cheapest phones to the largest number of people — treat monthly updates as non-negotiable, the gap between what's fixed and what's actually protected will keep showing up right where it hurts most.