My Pixel 10 Pro XL still showed the October 5 security patch when I checked for updates on November 3.
Image credit: Josh Kirschner/Techlicious
Google has published its November Android security bulletin, detailing critical vulnerabilities, including three that could let an attacker run malicious code remotely without the owner tapping, opening, or approving anything. Updates carrying a security patch level of November 5, 2026, or later will include all applicable fixes in the bulletin.
Google’s bulletin does not report any instances of the three remote-code-execution flaws being used in real attacks, and it has shared few details about how they would work.
The bulletin also details a fix for a bug nicknamed the “SMS of Death.” Google classifies the bug as a critical remote denial-of-service flaw (one that lets an attacker disrupt a device from afar) affecting Android 14 through 17. In a security researcher’s tests, a specially crafted text message crashed the phone’s calling service, dropping calls and, in some cases, causing repeated crashes or reboots. Public exploit code exists, but no malicious campaign or victim has been identified.
The researcher published details and working test code on October 29, initially identifying October’s update as the fix. Google’s November bulletin now lists the vulnerability among those addressed by the November 1 security patch level for Android 14 through 17.
Your phone’s Android security update date tells you which fixes are covered. A November 1, 2026, patch level covers the SMS flaw and the three remote-code-execution vulnerabilities. November 5 adds the remaining applicable fixes, including those for phone chips and the operating system’s core.
Samsung published its November security bulletin on November 3, listing 20 critical Google fixes and 24 Samsung-specific security issues. Its package includes the three remote-code-execution flaws and the SMS bug. Availability varies by model and region, and Samsung cautions that some chipset fixes may arrive in later updates.
To check, open Settings, then Security & privacy, then System & updates, and look at the Android security update date. Install any available system updates. Menu names vary by phone. As of November 3, the update wasn’t yet available on my Pixel 10 Pro XL.
On a Samsung phone, go to Settings, Software update, then Download and install. Once it’s installed, look for “SMR Nov-2026 Release 1” under Security software version, Samsung’s identifier for its November security release.
If your phone runs Android 12 or 13 and no longer receives security updates, consider replacing it. The researcher reports that older versions are vulnerable, while Google’s bulletin lists fixes for Android 14 through 17. Check with your manufacturer to see whether your particular phone will receive a fix.
