Google's November Android update fixes a zero-click flaw and a phone-crashing text message bug

Google published its monthly Android Security Bulletin on November 2, disclosing fixes for 217 vulnerabilities across the operating system, including a critical flaw that lets an attacker run malicious code on a phone without the owner clicking, opening or even seeing anything. The release, one of the larger monthly patch batches Google has issued this year, arrives alongside continued fallout from a separately disclosed bug, dubbed the "SMS of death" by researchers, that can crash an Android phone's calling function and drop active calls, including emergency calls, using a single malformed text message that never appears in the inbox.

Of the 217 issues listed in the bulletin, 23 are rated critical. The most severe, tracked as CVE-2026-58868, affects the Framework component that underlies the operating system's core services. Google's own description leaves little ambiguity about the risk.

No additional execution privileges needed. User interaction is not needed for exploitation.

Two additional critical remote-code-execution bugs, CVE-2026-58876 and CVE-2026-58936, affect the System component; the first is also patched through a Google Play system update to the device's media codecs, meaning some phones may receive that portion of the fix automatically. Google is shipping the patches in its now-standard two-part schedule, which splits fixes between a security patch level dated 2026-11-01, covering the Android runtime, Framework, System and Play system components, and a second level dated 2026-11-05, covering the Linux kernel and chipset-maker code from Arm, MediaTek, Qualcomm, Unisoc and Imagination Technologies. Google's documentation on the patch-level system notes that devices updated to the later date receive every fix in the bulletin, while those on the earlier date are still missing the kernel- and chipset-level repairs, which this month include six critical kernel bugs and eight critical flaws in MediaTek modem firmware.

A patch system built for fragmentation

The monthly bulletin is the backbone of how Google distributes security fixes across an operating system that, unlike Apple's iOS, runs on hardware built by dozens of manufacturers and sold through hundreds of carriers, each with its own update timeline. Google writes and tests the fixes, publishes them to the Android Open Source Project, and then depends on phone makers to build, test and push them to individual devices, a process that can take anywhere from days to months depending on the manufacturer. Samsung, the largest Android device maker, released its own November security update package on November 3, folding Google's fixes together with patches for Samsung's own semiconductor components and software. According to a breakdown reported by eSecurity Planet, Samsung's package addresses roughly 206 vulnerabilities in total, combining 178 fixes sourced from Google with 4 Samsung Semiconductor patches and 24 issues specific to Samsung's own code, though the company, as usual, gave no firm timeline for when individual devices will receive it, since rollout varies by model, carrier and region.

The bug Google initially dismissed

The bulletin also formally lists CVE-2026-58882, a critical denial-of-service flaw better known by the name independent researcher Mark Blaszczyk gave it when he published his findings on October 29. The vulnerability lies in how Android's telephony stack parses WAP Push messages, an older SMS-based format still used for provisioning and notifications. According to a technical write-up summarized by CyberInsider, an unchecked integer conversion in the code that handles these messages, inside a file called WapPushOverSms.java, can produce a negative header length that triggers a crash in the phone process, ending active calls and leaving the device in a loop of repeated failures as the carrier network resends the malformed message.

Blaszczyk reported the flaw to Google on May 5, and according to his account, as relayed by Android Authority, the company initially classified it as a non-security issue before engineers quietly built a fix months later. He disclosed the bug publicly in late October after testing it on both Google Pixel and Samsung Galaxy devices, warning that as few as around 20 malicious messages could leave a phone effectively unusable, potentially trapping it in a reboot loop that a factory reset might not resolve if a carrier keeps redelivering the queued messages. Google shipped a fix to supported devices in October, and this month's bulletin lists the issue as resolved for Android 14 through 17.

Who remains exposed

The practical risk is concentrated at the edges of Android's support lifecycle. Google's fix does not reach phones still running Android 12 or 13 that are no longer receiving full platform updates, a population that includes older but still widely used budget and mid-range devices. GrapheneOS, a security-focused Android variant, has said it incorporated the underlying fix as early as its July builds, ahead of Google's own public timeline, underscoring how unevenly patches reach the broader Android ecosystem even when a company-level fix exists. The emergency-call angle gives the bug an unusual real-world stake: a phone that silently drops a 911 call because of a malicious text, rather than a network outage, is a scenario regulators and carriers have not previously had to account for in testing mobile security.

Owners of affected devices face a familiar set of options:

• Check the device's security patch level in Settings and install any pending update immediately.
• Confirm Google Play system updates have installed, since some fixes, including one of this month's critical bugs, arrive through that channel rather than a full firmware update.
• Devices still on Android 12 or 13 that no longer receive vendor updates remain at elevated risk and have no straightforward mitigation short of replacement or a security-focused alternative operating system.

What comes next

Neither Google's bulletin nor the independent reporting on it describes any of this month's critical flaws as being exploited in the wild, which distinguishes the release from several earlier 2026 bulletins that patched bugs already under active attack. That absence of known exploitation gives device makers some breathing room to test and roll out updates, but it does not change the underlying exposure: a zero-click Framework vulnerability and a publicly documented, proof-of-concept-equipped SMS bug both now exist in the open, which security researchers generally treat as an invitation for criminal groups to reverse-engineer working exploits from the patch itself. The next scheduled Android bulletin is expected in early December, continuing a monthly cadence that has, over the course of 2026, repeatedly surfaced critical flaws reaching deep into the phone components that manufacturers, not Google, are responsible for fixing.