Here's your monthly reminder that the phone in your pocket is a computer that talks to strangers all day. Google's November Android bulletin is a big one, and two entries in it are worth your attention.
What Google Fixed
Google published the November 2026 Android Security Bulletin on November 2. The Hacker News counts 216 vulnerabilities, 23 of them rated Critical.
- CVE-2026-58868: a Critical remote code execution flaw in the Framework that needs no user interaction. Per The Hacker News, it's an out-of-bounds write from a heap overflow in
FrameDecoder.cpp, affecting Android 14 through 17. Neither the bulletin nor the CVE record says how an attacker reaches it. Fixed at patch level 2026-11-01. - CVE-2026-58882: a Critical remote denial of service in the System component, in the WAP Push SMS handling code.
- Two more Critical RCEs in System (CVE-2026-58876 and CVE-2026-58936), plus Critical kernel bugs in Bluetooth, pKVM and HID, and Critical issues in MediaTek modem code and a Qualcomm component.
Exploitation: the bulletin doesn't flag any of these as exploited, and as of November 4 none were in CISA's KEV catalog.
About That "SMS of Death"
On October 29, researcher Mark B published a write-up called "SMS of Death": a single malformed WAP Push message that crashes the phone service, ends active calls (including emergency calls), never shows up in the inbox, and keeps crashing the phone at every restart until the message is removed. All the attacker needs is your number. A proof-of-concept is public.
CVE-2026-58882 sits in the same code (decodeWapPdu), and several outlets treat it as the same bug. Google hasn't explicitly said so, and reporting on exactly which monthly update first carried the fix differs, so I'll keep it simple: get the newest patch your phone offers. The researcher also says Android 12 and 13 run the same code but aren't getting the fix.
A bug that only crashes a phone sounds minor until you remember what phones are for. A text that can knock someone off a 911 call is not a nuisance bug.
What To Do
- Check your patch level: Settings, About phone, Android version, then look at "Android security update." You want 2026-11-05 or later to cover everything in this bulletin. 2026-11-01 covers the Framework RCE.
- Check Google Play system updates too. Some fixes ship that way, but not CVE-2026-58868, so the security update date is what matters for that one.
- Your manufacturer and carrier set the schedule. Pixels get it first. Others follow on their own timeline. If your phone hasn't seen an update in months, that's your answer about whether it's still supported.
- Android 12 and 13 devices: treat them as exposed to the SMS of Death issue. If it's a work phone, it's time for a replacement conversation.
- IT teams: set a minimum patch level in your MDM and block or restrict devices that fall behind. Unsupported phones shouldn't have access to corporate apps.
Bottom Line
Zero-click bugs are the scariest kind because you can't train users out of them. There's no link to avoid and no attachment to not open. The only defense is the patch, so go check your phone.
Sources: Android Security Bulletin, November 2026, The Hacker News, eSecurity Planet on SMS of Death, and Google, check and update your Android version