---
title: Android's November 2026 bulletin fixes critical no-click RCEs in Framework and System, critical kernel Bluetooth and pKVM bugs, and critical MediaTek modem and Qualcomm flaws | ctxsec
url: https://ctxsec.com/items/android-security-bulletin-november-2026-critical-framework-system-rce
description: "Google published the Android Security Bulletin for November 2026 on Nov 2. The most severe issue is a critical remote code execution bug in Framework (CVE-2026-58868) that needs no user interaction; System has two more critical RCEs (CVE-2026-58876, CVE-2026-58936). The 2026-11-05 patch level adds critical kernel fixes in Bluetooth, pKVM and HID plus critical MediaTek modem and Qualcomm closed-source bugs. The bulletin does not say any of these issues is under limited, targeted exploitation."
status: "official (Android Security Bulletin, November 2026, published Nov 2); the bulletin does not mark any issue as exploited"
published: 2026-11-03
---

> Google published the Android Security Bulletin for November 2026 on Nov 2. The most severe issue is a critical remote code execution bug in Framework (CVE-2026-58868) that needs no user interaction; System has two more critical RCEs (CVE-2026-58876, CVE-2026-58936). The 2026-11-05 patch level adds critical kernel fixes in Bluetooth, pKVM and HID plus critical MediaTek modem and Qualcomm closed-source bugs. The bulletin does not say any of these issues is under limited, targeted exploitation.

[← Cybersecurity News](/news) · [markdown](/items/android-security-bulletin-november-2026-critical-framework-system-rce.md)

official (Android Security Bulletin, November 2026, published Nov 2); the bulletin does not mark any issue as exploited

2026-11-03

### Android's November 2026 bulletin fixes critical no-click RCEs in Framework and System, critical kernel Bluetooth and pKVM bugs, and critical MediaTek modem and Qualcomm flaws

- **2026-11-01 patch level:** Framework CVE-2026-58868 (critical RCE, Android 14–17) plus dozens of high-severity EoP, info-disclosure and DoS bugs; System CVE-2026-58876 and CVE-2026-58936 (critical RCE), CVE-2026-55275, CVE-2026-55283 and CVE-2026-58984 (critical EoP), CVE-2026-58814 and CVE-2026-58882 (critical DoS). Some fixes ship via Google Play system updates (Media Codecs, MediaProvider, Telephony, WiFi).
- **2026-11-05 patch level:** critical kernel EoP in Bluetooth (CVE-2026-53256, CVE-2026-89774), pKVM (CVE-2026-59044, CVE-2026-59045) and HID (CVE-2026-80604), plus pKVM info disclosure CVE-2026-59048; eight critical MediaTek modem CVEs (CVE-2026-20499, -20519, -20520, -20545 to -20549); Qualcomm closed-source CVE-2026-25285; and Arm Mali, Imagination PowerVR and Unisoc fixes.

**What to do:** install updates showing patch level 2026-11-05 as OEMs ship them; Pixel usually gets them first. For managed fleets, set a minimum patch level in MDM so devices that stay behind are flagged.

Sources: [Android Security Bulletin—November 2026 (published Nov 2)](https://source.android.com/docs/security/bulletin/2026/2026-11-01)