Android security patch level: what the date means, and the November 2026 update

Your Android security patch level is shown as a date, such as 2026-11-05, and Google's Android Security Bulletins use that date to say which fixes a phone includes. Google's November 2026 bulletin, published on 2 November, says "Security patch levels of 2026-11-05 or later address all of these issues."

What does the security patch level date mean?

Google's November 2026 Android Security Bulletin groups its fixes under two patch level dates, and its answer to "How do I determine if my device is updated to address these issues?" is:

• "Security patch levels of 2026-11-01 or later address all issues associated with the 2026-11-01 security patch level."
• "Security patch levels of 2026-11-05 or later address all issues associated with the 2026-11-05 security patch level and all previous patch levels."

So a later date includes the earlier fixes. Google says devices on a given patch level must also include the fixes from all previous bulletins.

Why are there two dates in one month?

Google's bulletin explains that it has two security patch levels "so that Android partners have the flexibility to fix a subset of vulnerabilities that are similar across all Android devices more quickly." The 2026-11-01 level covers the issues in the bulletin's first section. The 2026-11-05 level covers those and the second section, which in November 2026 covers kernel components and components from Arm, Imagination Technologies, MediaTek, Qualcomm and Unisoc. Google encourages manufacturers to fix every issue and use the latest level.

How do I check my Android's patch level?

Google's steps:

1. Open your phone's Settings app.
2. Tap About phone (or About tablet) > Android version.
3. Look at Android security update for the patch level date. The same screen shows your Android version, Google Play system update and build number.

How do I install the update?

Google says most system updates and security patches install automatically, and you'll get a notification when one is available. To check yourself:

1. Open Settings.
2. Tap System > Software updates.
3. Follow the on-screen instructions.

Google says Pixel phones install updates in the background and they become active the next time you restart. Many other Android phones restart on their own while installing. Google also notes that "Older devices can't always run newer Android versions", and that to get the latest security update you need the latest Android version available for your device. Our guide to a free security app for Android covers turning on automatic updates and Google Play Protect.

What does the November 2026 bulletin fix?

By our count of the bulletin's tables, it lists 216 vulnerabilities: 119 under the 2026-11-01 patch level (8 rated Critical, 111 High) and 97 under 2026-11-05 (15 Critical, 82 High). That's 23 Critical and 193 High in all.

The bulletin says the most severe is "a critical security vulnerability in the Framework component that could lead to remote code execution with no additional execution privileges needed." That's CVE-2026-58868, listed for Android 14, 15, 16, 16-qpr2 and 17. For what remote code execution means, see what is remote code execution?, and for how CVE numbers and ratings work, CVE and CVSS explained.

Google adds that its severity ratings assume "the platform and service mitigations are turned off for development purposes or if successfully bypassed."

Is this a zero-click vulnerability?

The bulletin doesn't use the phrase "zero-click". What it says about the Framework issue is: "User interaction is not needed for exploitation."

The November 2026 bulletin contains no statement that any of these issues has been exploited. Installing the update is still the fix. If you're worried about signs on your phone, our guide on how to tell if your Android is hacked goes through Google's checks, and what is a vulnerability? explains the basics.

What about the Google Play system update?

The bulletin says devices with Android 10 and later may receive security updates as well as Google Play system updates, and that for some devices on Android 10 or later, "the Google Play system update will have a date string that matches the 2026-11-01 security patch level." It lists some issues as included in these components, among them Media Codecs and MediaProvider. The date shows on the same About phone screen.

More questions

Why doesn't my phone have the November patch yet?

Google says update schedules vary by device, manufacturer and mobile operator. Google says it notifies Android partners of all issues at least a month before publishing the bulletin. For a phone other than a Pixel, Google suggests contacting the manufacturer or operator.

Is 2026-11-01 enough?

It covers every issue in the bulletin's 2026-11-01 section. The 2026-11-05 level covers everything in the November 2026 bulletin, including the kernel and chip maker components in its second section. Install whatever your manufacturer offers.

Do Samsung and other manufacturers have their own bulletins?

They may. Google's bulletin says device and chipset makers may publish security details specific to their products, and names Google, Huawei, LGE, Motorola, Nokia and Samsung as examples. Those extra fixes aren't required to declare a patch level.

Was anything in the November 2026 bulletin exploited?

The bulletin doesn't say so. It describes the most severe issue as allowing remote code execution with no user interaction needed, and rates it Critical, but there's no note of exploitation.

Does Google Play Protect help in the meantime?

Google says Play Protect is on by default on devices with Google Mobile Services, warns about potentially harmful apps, and is especially important if you install apps from outside Google Play. The bulletin also encourages all users to update to the latest version of Android where possible.

Sources

• Android Security Bulletin, November 2026, Android Open Source Project
• Check and update your Android version, Google