Google has sent out its November Android security update, and it fixes 23 flaws that Google rates as Critical. The worst one could let a hacker run their own code on your phone without you tapping anything. Google’s bulletin does not mention any attacks that use these bugs. Even so, a fix only helps after it reaches your phone, so it is worth checking today.
What Google Fixed This Month
Google published its Android Security Bulletin on 2 November 2026. It covers Android itself and software from several chip makers. In Google’s tables, 23 of the flaws are marked Critical.
The most serious one sits in Android’s Framework. Google’s bulletin rates it Critical. Google says an attacker could use it to run their own program on a phone from far away. The bulletin says the phone’s owner would not have to do anything. Two more Critical bugs of this kind are in the System table, so three bugs in total could run code from far away.
Two Patch Dates, Two Rounds of Fixes
Every Android phone shows a security patch level. This is the date of the newest fixes installed on it. Google’s November bulletin has two of these dates.
If your phone shows 2026-11-01 or later, it has the fixes for the Framework, System and Android runtime. That includes the three bugs that could run code from far away. If it shows 2026-11-05 or later, it has every fix in the bulletin. That adds the kernel, which is the heart of the system, and parts made by Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm.
The later date also covers Critical bugs in MediaTek’s modem software. The modem is the chip that connects your phone to the mobile network.
Which Phones Are Covered
Google lists fixes for Android 14, 15, 16 and 17. It lists nothing for older versions. If your phone is older, ask its maker about updates.
To check, open Settings and look for the Android security update date. The menu name is different on each brand. You want to see 2026-11-05 or later.
Google also points to Play Protect, a built-in app scanner that is on by default. It matters most if you install apps from outside the Play Store.
What Is Still Unclear
Google’s bulletin does not say that anyone is using these bugs to attack phones. The Hacker News also reported that none of them were on a U.S. government list of bugs known to be under attack, kept by an agency called CISA, as of 3 November.
The bigger problem is waiting. Google makes the fixes, but phone makers and carriers decide when each phone gets them. Techlicious reports that Samsung says some chip fixes may come in later updates.
What Happens Next
Each phone brand now sets the date for its own models. Samsung, Motorola, Nokia and others have their own security pages, and Google’s bulletin links to them. Check your brand’s page to see when your phone is due.
Most people ignore security updates. This one is worth two minutes of your time. Check your patch date, install the update when it shows up, and keep Play Protect turned on.
