Android November 2026 Security Update Fixes 216 Flaws, but Android 12 and 13 Miss the SMS of Death Fix

The bigger story, though, is the bug that didn’t get fixed for everyone. A crash exploit nicknamed “SMS of Death” is patched for newer Android versions, but phones on Android 12 and 13 are left without a fix, according to SecurityWeek’s report on the November updates and several other outlets.

Quick answer: Google’s November 2026 update fixes 216 Android flaws, 23 rated Critical and 193 rated High. A security patch level of 2026-11-05 or later covers everything in the bulletin. The SMS of Death bug (CVE-2026-58882), which can crash your phone’s calling service with one text, is fixed only on Android 14 to 17, and Google hasn’t said whether Android 12 and 13 will ever get a fix.

What Google fixed this month

According to Google’s official Android Security Bulletin for November 2026, the fixes come in two batches, called patch levels. A patch level is simply the date your phone’s security fixes are current to.

• 2026-11-01: 119 flaws in Framework (65), System (53) and Android runtime (1).
• 2026-11-05: 97 flaws in the Kernel and in components from Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm. More than a dozen are Critical, in areas like Bluetooth, pKVM, HID, the MediaTek modem and a Qualcomm closed-source component.

The headline bug is CVE-2026-58868, a Critical memory flaw in Framework that allows remote code execution. An attacker needs no extra privileges, and you don’t have to do anything for it to work. It affects Android 14, 15, 16, 16 QPR2 and 17. Two more Critical remote code execution flaws, CVE-2026-58876 and CVE-2026-58936, sit in the System component.

Some good news: the bulletin doesn’t mark any of these flaws as being used in real attacks. Also, 17 of them were already fixed earlier through Google Play system updates. Wear OS and Android XR got their own small updates on the same day.

The SMS of Death bug left on Android 12 and 13

CVE-2026-58882 is the one I’d pay attention to. A single specially crafted WAP Push message (a type of system text message) can crash com.android.phone, the service that handles calls and mobile signal. That cuts your cell service and ends any active call, even an emergency call. It’s zero-click, and the message never appears in your inbox.

Reports say around 20 such messages can trap a phone in a reboot loop. In one case, an Android 12 phone kept rebooting into recovery mode about every 90 seconds, and only a factory reset fixed it. The researcher who found the bug has published a working exploit.

Google quietly fixed it for Android 14 to 17 in October without listing it in that month’s bulletin. November’s bulletin now lists it as Critical, but again only for Android 14 to 17. No real-world attacks had been reported as of November 3.

One caution: if your phone suddenly loses signal, it’s far more likely to be an ordinary network problem. My guide on how to fix the Android “not registered on a network” error covers the usual causes.

Which phones get the update

The bulletin covers Android 14, 15, 16, 16 QPR2 and 17. Phone makers and carriers roll out the fixes on their own schedules, so you may not see it right away. I couldn’t confirm the exact Pixel or Samsung November rollout dates or model lists yet.

The worrying number comes from Cybernews, which says 43.6% of active devices run Android 13 or older and no longer get security fixes. If that’s your phone, there’s no official workaround from Google, so it may be time to think about an upgrade.

How to check your patch level

Open Settings and look for “Android security update” or “security patch level” (typing “security update” into the Settings search bar is the quickest way, since menu names differ by brand). If it says 2026-11-01 or later, you have the Framework and System fixes, including CVE-2026-58868. If it says 2026-11-05 or later, you have the full bulletin.

If you’re on a Galaxy phone and a recent big update has left things sluggish, my guide to fixing One UI 9 battery drain and freezing may help.

What’s next

Install the November update as soon as your phone offers it. The real question is whether Google will backport the SMS of Death fix to Android 12 and 13, and so far it hasn’t said. If you manage phones for a team, this is a good moment to review your setup with these cybersecurity tools for small businesses. I’ll update this post when Pixel and Samsung rollout details are clear.

Frequently Asked Questions

How many vulnerabilities does the Android November 2026 security update fix?

Google’s bulletin fixes 216 flaws in total, with 23 rated Critical and 193 rated High, split across the 2026-11-01 and 2026-11-05 patch levels.

Is the SMS of Death bug fixed on Android 12 and 13?

No. CVE-2026-58882 is fixed only on Android 14 to 17. Google hasn’t said whether Android 12 and 13 will ever get a fix.

Which security patch level do I need?

2026-11-01 or later covers the Framework, System and runtime fixes, including CVE-2026-58868. 2026-11-05 or later covers everything in the November bulletin.