Android November 2026 Security Update: What's Fixed, Pixel Timing

Google's Android security program published its November 2026 bulletin on November 2, and it is one of the heavier patch rounds of the year: 216 vulnerabilities fixed across two patch levels, 23 of them rated Critical, including a pair of remote-code-execution bugs that need no interaction from the phone's owner at all. Pixel phones from the 7-series onward, every current foldable, and the Pixel Tablet are first in line for the fix. The Pixel 6 and Pixel 6 Pro are not, because their five-year update guarantee ran out last month.

What Google actually patched this month

The Android Security Bulletin for November 2026 lists 216 vulnerabilities in total, tallied across its Framework, System, Kernel, and vendor-component tables. Google rates 23 of those Critical and the remaining 193 High. That is a noticeably heavier month than September or October, when the combined bulletins each stayed under 180 issues, and it is a useful reminder that the size of these monthly releases varies a lot more than most phone owners realize.

Google notes, as it does every month, that it has no evidence any of November's bugs are being actively exploited in the wild, and that Android's own defenses, Google Play Protect scanning chief among them, already reduce the practical risk of most entries on the list before a device even installs the patch. That caveat matters: a long CVE list sounds alarming out of context, but the overwhelming majority of these issues require either local access, a malicious app already installed, or a specific chain of other conditions to actually matter to an ordinary user.

The bulletin covers the full stack Google is responsible for coordinating across the Android ecosystem: the core Framework and System components that every Android phone shares regardless of manufacturer, plus the Kernel and the chipset-specific code supplied by Arm, Imagination Technologies, MediaTek, Qualcomm, and Unisoc. Google ships the underlying source patches to the Android Open Source Project within 48 hours of the bulletin going live, which is what lets phone makers outside the Pixel line start building and testing their own updates almost immediately rather than waiting weeks for the fix to even become available to them.

The two patch levels, explained

Android security bulletins have been split into two separate security patch levels for years now, and the date string a phone reports in Settings tells you which set of fixes it actually has — not just which month.

A device that reports the 2026-11-05 patch level carries every fix from both batches, which is why Google instructs manufacturers to ship whichever level is newest rather than mixing fixes from the two. If your phone's About page still shows an October date after November 6, the update simply has not reached your specific device or carrier combination yet — it does not necessarily mean anything is broken.

The most serious bugs this month

Most of the 23 Critical entries sit in code most people never think about: media codecs, kernel drivers, Bluetooth stacks, virtualization layers. A handful stand out in Google's own notes because they are described as exploitable without any action at all from the phone's owner.

None of this means a typical owner is at immediate risk. Exploiting most of these bugs still requires a chain of other conditions to line up, and Google has said none are currently known to be under active attack. It is simply why the monthly patch cycle exists in the first place: close the gaps before anyone finds a reliable way to use them, rather than scrambling after the fact.

Which phones get it first

Pixel devices get first access because Google builds, tests, and ships the AOSP fixes before any other manufacturer even has the final code in hand. Right now that means every Pixel from the 7-series onward, every Pixel a-series phone from the 7a on, the Pixel Fold line, the Pixel Tablet, and the current Pixel 9 and 10 families all qualify for this rollout as Google's own Pixel-specific update reaches each model, detailed separately on Google's Pixel Update Bulletins page. Our coverage of Android 17 QPR3's beta rollout covers the parallel feature-update track these same Pixel phones are testing alongside the monthly security patch.

Phones from Samsung, Motorola, OnePlus, and other manufacturers receive the identical underlying AOSP source fixes within that same 48-hour window, but each company still has to merge them with its own custom skin, carrier certification requirements, and internal testing pipeline before anything reaches a customer's phone. That is why non-Pixel phones routinely land their matching patch anywhere from two to six weeks later than Google's own devices, and why the exact same CVE can be "fixed" on one brand's flagship while still open on another's mid-range phone released the same year.

Why the Pixel 6 is sitting this one out

Google guarantees Pixel phones a fixed number of years of OS and security updates, counted from the date the device first went on sale on the Google Store in the US, not from whenever you personally bought yours. Under that published update policy, the Pixel 6 and Pixel 6 Pro are entitled to five years, and both launched in October 2021 — which put their support window right at its end heading into this fall. We covered the actual cutover in detail when the Pixel 6's five-year window closed, and last month's patch was effectively its final ride, a point we also noted when covering October's Pixel update. The Pixel 6a, which launched roughly eight months after the Pixel 6 in mid-2022, still has a few more months of coverage left under that same five-year rule before it faces the identical cutoff.

That same policy gives Pixel 7 and 7a owners five years counted from their own 2022 launch dates, while every Pixel 8, 8a, 9, and 10 model — plus Pixel's foldable phones — carries a longer seven-year commitment that Google only started offering from the Pixel 8 generation onward. If your Pixel is anywhere on that newer list, this month's update is simply business as usual and nothing about your support timeline has changed.

What this means if you are not carrying a Pixel

If you carry a Galaxy, OnePlus, Xiaomi, or any other Android phone, November's AOSP fixes are the baseline every manufacturer builds their own update from, but your actual timeline depends entirely on that company's own release schedule rather than Google's. Samsung typically folds the matching AOSP fixes into its own monthly security maintenance release a few weeks after Google's bulletin goes out, and other brands vary considerably more widely than that; some budget and older mid-range phones only receive security patches on a quarterly basis, or in a few cases, not at all once they age out of their manufacturer's support list. Checking your own device's software-update settings directly, rather than assuming based on what a flagship phone from the same brand is doing, remains the only reliable way to know what patch level you are actually running today.

How to check for and install it

On any Pixel, or most phones running close to stock Android, the path is: open Settings, then System, then System update, and tap Check for update. The patch level itself is listed separately, under Settings, About phone, Android version, next to the line labeled "Security update." On Samsung, Motorola, and other heavily skinned phones, the equivalent menu path is usually Settings, Software update, Download and install. If nothing appears yet on your phone, the update for your specific model, region, and carrier combination simply has not been pushed out to you yet — Google and most manufacturers stagger these rollouts over one to three weeks rather than pushing every eligible device on the same day, partly to catch any last-minute problems before they reach everyone at once.

Why the patch-level system exists at all

Android ships across many thousands of distinct hardware and chipset combinations from dozens of manufacturers, which is a fundamentally different problem from a single company patching one tightly controlled phone lineup. Splitting each monthly bulletin into an 11-01 level for shared Framework and System code and an 11-05 level for Kernel and chipset-specific code lets Google and individual chip vendors fix issues on different timelines, without forcing every manufacturer on earth to wait for whichever supplier happens to be slowest that month. It is also exactly why two different phones can both report "Android security patch level: November 2026" in their settings while actually running meaningfully different sets of underlying fixes, depending on which specific patch level they report — reading the full date string in Settings, not just the month name, is the only way to know for certain which fixes a given phone actually has installed.

For more background on how Android's update and patch-level system is structured more broadly, Google's own Android security updates and resources overview walks through how source code, binary drivers, and OEM builds fit together across a given release cycle, and the Android version history page on Wikipedia is a useful reference for how major and quarterly releases like Android 17 and its QPR updates line up against this separate monthly security cadence.

What's next

Google's next scheduled bulletin lands in early December, and it typically arrives alongside one of the year's more feature-heavy Pixel software pushes rather than as a quiet security-only patch. Expect the Pixel 6a to receive one of its last few updates under the five-year policy sometime in early-to-mid 2027, following the same timeline the standard Pixel 6 and Pixel 6 Pro just reached. Expect the gap between Google's own rollout and everyone else's to stay roughly where it has been all year: Pixel phones first, Samsung and other major manufacturers a few weeks behind, and budget or older devices trailing considerably further depending on the specific manufacturer and carrier involved. For now, the single most useful thing any Android owner can do with this information is open Settings and actually check for an update, rather than assume one has already quietly arrived.

Written byNadia Osei

Nadia Osei covers mobile and consumer gadgets for Pandromeda: smartphones, tablets, smartwatches, earbuds and smart-home devices. She tracks launches, software updates and pricing across Apple, Google, Samsung and the rest, and builds comparisons from the manufacturers' published specifications.

More from Nadia OseiAll Mobile & Gadgets coverage