Google’s November 2026 Android bulletin: three critical RCEs and patch levels

Google’s November 2026 Android Security Bulletin, published November 2, lists three Critical remote-code-execution (RCE) vulnerabilities: one in Framework and two in System. An RCE flaw can let an attacker run code remotely on a device. Google says exploiting these three flaws does not require user interaction.

What the bulletin lists

The bulletin lists all three vulnerabilities for Android 14, 15, 16, 16-qpr2 and 17. It identifies one flaw in Framework, Android’s application framework, and two in the System component.

Google describes the Framework vulnerability as the bulletin’s most severe issue. Its severity ratings assume platform and service mitigations are disabled for development or successfully bypassed.

What the two patch levels cover

The two November patch levels cover different sets of fixes. Google says it offers them so Android partners can deliver a subset of fixes shared across devices sooner.

Google encourages partners to include all applicable fixes and use the latest patch level. So the date matters: 2026-11-01 identifies its assigned set of fixes, while 2026-11-05 or later covers all issues in the November and earlier bulletins.

The bulletin date and a phone’s update date

Google published the bulletin on November 2, 2026. It says Android partners receive notice of issues at least a month before publication and decide how to deliver applicable fixes to their devices. The bulletin’s publication date and the patch level on a particular phone are separate points in that process.