Google on Monday announced new security updates for Android that resolve more than 200 vulnerabilities, including two dozen critical-severity issues.
The first part of the patches arrives on devices as the 2026-11-01 security patch level and resolves 119 security defects across Android runtime, Framework, and System.
Framework received fixes for the largest number of flaws, namely 65, followed by System with 53. Google resolved one high-severity information disclosure bug in Android runtime.
According to Google’s security bulletin, the most severe of the patched weaknesses resides in the Framework component and is tracked as CVE-2026-58868.
“The most severe of these issues is a critical security vulnerability in the Framework component that could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation,” the company says.
Critical-severity remote code execution (RCE), elevation of privilege (EoP), and denial-of-service (DoS) vulnerabilities were addressed in the System component as well.
Google rolled out patches for 17 of these flaws ahead of the monthly rollout, as part of Google Play system updates.
The second part of Android’s November 2026 security updates arrives on devices as the 2026-11-05 security patch level and fixes 97 bugs in Kernel, Arm, Imagination Technologies, MediaTek, Unisoc, and Qualcomm components.
While most of the fixes target high-severity issues, more than a dozen of them resolve critical-severity weaknesses in subcomponents such as Bluetooth, pKVM, HID, MediaTek modem, and a Qualcomm closed-source component.
“Security patch levels of 2026-11-05 or later address all of these issues,” Google notes.
On Monday, Google also published security bulletins for Android XR and Wear OS. In addition to the bugs described in the November 2026 Android bulletin, the Android XR update resolves a high-severity flaw in Framework, while the Wear OS patch addresses two high-severity issues in Framework and System.
Related: Google Dismantles XCPE Botnet of 1.3 Million Android Devices
Related: Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward
Related: Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
Related: Android’s October 2026 Updates Patch 25 Vulnerabilities
