Other cyber events · Developing
Google fixed a serious Android flaw. One settings check tells you if your phone got the fix
Google's November Android update fixes a flaw that lets an attacker run instructions on a phone without a tap. A phone needs the 2026-11-01 update level or later. The phone shows its update date in Settings.
What happened
Google published its Android security bulletin for November 2026 on November 2, 2026.
The bulletin fixes a critical flaw that lets an attacker run their own instructions on a phone.
A person using the phone does not need to tap anything or accept anything.
The flaw carries the identifier CVE-2026-58868. It affects phones on Android versions 14, 15, 16, and 17.
The same update fixes two more critical flaws of the same kind. Their identifiers are CVE-2026-58876 and CVE-2026-58936.
The update also fixes a critical flaw that a single silent text message can use to crash the phone service.
Phone makers and carriers send the security update on their own schedules. Phones on the same Android version receive it at different times.
Sources: Android Security Bulletin—November 2026; Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction
Who’s affected
This flaw affects people who use an Android phone on version 14, 15, 16, or 17.
The fix reaches a phone with a security update level of 2026-11-01 or later.
A phone with an older date does not have these fixes yet.
Google did not report any attack that used this flaw when it published the bulletin.
Sources: Android Security Bulletin—November 2026; Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction
What to do
- Open the Settings app on your Android phone.
- Tap About phone or About tablet. Then tap Android version.
- Find the Android security update date in the list.
- Make sure that the date reads 2026-11-01 or later.
- If the date is older, go back to Settings.
- Tap System, then Software updates.
- Install the update the phone offers. If the phone asks you, restart it.
- Repeat this check once each month. Google publishes a new Android security update each month.
Sources: Android Security Bulletin—November 2026; Check & update your Android version
What we do not know yet
The bulletin does not say that anyone used the flaw on a real phone.
We do not know whether your phone received the update. The date in Settings is the only check.
Google publishes the fix's code within two days after the bulletin. The detailed flaw information comes later.
The bulletin does not say when each phone maker will send the update.
Sources: Android Security Bulletin—November 2026; Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction
Guides for your next step
Sources
- Android Security Bulletin—November 2026
Google Android Security
- Check & update your Android version
Google Android Help
- Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction
The Hacker News