Google’s November 2026 Android security bulletin addresses 23 critical vulnerabilities, including remote code execution flaws and the recently disclosed “SMS of Death” bug that can silently disconnect calls.
The security bulletin lists fixes across Android’s Framework, System, runtime, kernel, and hardware vendor components. Devices with a security patch level of 2026-11-05 or later address all issues covered this month.
The most severe Framework vulnerability, tracked as CVE-2026-58868, could allow remote code execution without additional execution privileges or user interaction. Google lists updated releases for Android 14, 15, 16, 16 QPR2, and 17.
Android’s Framework and System components provide core functions used by applications and device services. Two additional critical remote code execution flaws, CVE-2026-58876 and CVE-2026-58936, affect the System component across the same releases. Google also includes the former in fixes delivered through Google Play system updates for Media Codecs.
‘SMS of Death’ gets a critical rating
One notable entry is CVE-2026-58882, the denial-of-service vulnerability we recently covered as “SMS of Death.” Google now lists it as a critical System flaw under the 2026-11-01 patch level, with updated AOSP versions spanning Android 14 through 17.
Independent researcher Mark Blaszczyk disclosed the issue on October 29 after reporting it to Google on May 5. His technical write-up describes how a malformed WAP Push data message can crash Android’s com.android.phone process, terminating active calls, including emergency calls.
The telephony framework processes the message without showing it in the inbox or requiring the recipient to open anything. An unchecked integer conversion in WapPushOverSms.java can turn a message header length into a negative value, triggering an exception when Android attempts to allocate memory.
Blaszczyk reported that repeated delivery and queued messages could cause recurring crashes, including after restarting. A proof-of-concept is publicly available.
Although the researcher says Google’s fix shipped in October, the vulnerability is formally documented in November’s bulletin. Its inclusion should therefore not be read as proof that every previously updated device remained vulnerable until this month.
Kernel and chipset fixes
The 2026-11-05 patch level adds six critical kernel vulnerabilities affecting Bluetooth, human interface device handling, and protected virtualization (pKVM). Five are privilege escalation issues, while the sixth could expose information.
Hardware-specific fixes include eight critical MediaTek modem vulnerabilities and one critical Qualcomm closed-source flaw. Additional high-severity issues affect Arm, Imagination Technologies, Unisoc, and other vendor components; applicability depends on each device’s hardware.
Users should install the latest update offered by their device manufacturer and check the Android security update date in Settings. The 2026-11-01 level covers the Framework and System fixes, including “SMS of Death,” while 2026-11-05 covers the complete bulletin. Users should also check for Google Play system updates, which deliver fixes for selected modular components.
Leave a Reply