Android: November’s security update has two different patch levels
November’s bulletin separates 2026-11-01 from 2026-11-05. A Framework flaw allows code execution without a click: check the installed patch level, not just the Android version.
Getting started
Generated image · SecuFocus
At a glance
Key points
After updating your Android phone, check its security patch date. Google’s bulletin, published on 2 November, identifies 2026-11-05 or later as covering all applicable fixes in the bulletin. The 2026-11-01 level covers a first group, not the whole bulletin. A new Android version and a fully patched device are different checks.
The first and fifth of November cover different groups
Google separates platform fixes associated with 2026-11-01 from a second group that includes kernel and manufacturer components, associated with 2026-11-05. A device declaring the first level must also include fixes from earlier bulletins. The second level must include every applicable fix in this bulletin and earlier ones.
CERT-FR warns about devices without the 1 November patch. That initial threshold does not replace the broader 5 November scope specified by Google. Do not treat two phones as equally patched just because both screens say November.
| Security patch level | What Google’s bulletin establishes |
|---|---|
| 2026-11-01 or later | The first group and earlier fixes. |
| 2026-11-05 or later | All applicable bulletin fixes, including the second group. |
One Framework flaw requires no click
Google rates CVE-2026-58868 Critical in Framework, with remote code execution requiring neither additional execution privileges nor user interaction. The table lists updated AOSP versions 14, 15, 16, 16-qpr2 and 17. NVD describes an out-of-bounds write caused by a heap buffer overflow in FrameDecoder.cpp. Those conditions belong to this flaw, not every entry in the bulletin.
Google assesses severity assuming platform protections are disabled for development or successfully bypassed. The bulletin neither diagnoses your phone nor establishes active exploitation of this CVE. Google Play system updates also cover some components; their date alone does not establish that every manufacturer patch is installed.
Check the result on the model you use
Prepare your backup and recovery methods, then use your manufacturer’s or administrator’s update route. After restarting, record the model, Android version and security patch level actually displayed. If no update is offered, ask for confirmation of that model’s support and schedule: publication does not establish rollout to every device.
Samsung’s bulletin and the SMS of Death telephony flaw have separate articles linked below. Their appearance in the news does not replace checking your phone’s security patch level. SecuFocus read the bulletins and NVD record; no device or exploit was tested for this article.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
- NVD : CVE-2026-58868, défaut de décodage ↗services.nvd.nist.gov ·
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.