The November Android patch is two dates, not one install

A phone that reports a November 2026 Android update has not necessarily installed the month. Google's bulletin, published 2 November, draws the line at patch level 2026-11-05.

The line in the bulletin is the one Settings can answer: "Security patch levels of 2026-11-05 or later address all of these issues." A handset showing 2026-11-01 is on a November date and off the list Google says is complete.

The most severe issue, in Google's description, is a critical Framework flaw that could lead to remote code execution with no additional execution privileges needed. The 5 November block is a second inventory. Its severe entries include critical elevation of privilege in kernel components, and Google says user interaction is not required. The first date does not absorb the second.

eSecurity Planet and Malaysian Wireless total the bulletin at 216 vulnerabilities, dozens of them critical. That sum is their arithmetic on Google's tables, not a figure in the bulletin's introduction. The split that changes what a phone receives is simpler. The 1 November level carries the framework and system fixes. The 5 November level adds kernel issues and vendor code from firms including Qualcomm, MediaTek, Arm and Unisoc. A device left on 2026-11-01 can wear a November label and miss that second delivery.

The vulnerability with a nickname is CVE-2026-58882, called SMS of Death in the researcher write-ups. The November coverage places it on the 2026-11-01 level as a critical denial of service in System, with updated code listed for Android 14 through 17. The behaviour those accounts describe is a crafted WAP Push message that crashes the phone process, without anyone opening a text, and that can cut off a call already in progress. Emergency calls are included in that description.

Mark Blaszczyk, who reported the bug, stated it directly: "A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls), with zero interaction from the victim." Cybernews published that sentence. He also explained that the malformed message stays queued and is retried on every boot, so the handset can crash again at startup until the message is cleared.

Cybernews reported that a fix was already in the October 2026 update for Android 14 through 17, after Google committed one in June. A Pixel or Galaxy that installed October may already contain this particular patch. That does not retire the November bulletin. The framework remote-code-execution issue and the kernel list sit outside that one telephony bug, and only 2026-11-05 claims to close the full set.

The version column is a second limit. Blaszczyk's account, as Cybernews relayed it, says the flaw reaches Android 12 through 16. The November rows discussed by Malaysian Wireless and Cyber Insider list updated versions from Android 14 through 17. Phones stuck on Android 12 or 13 are outside those updated lines. The bulletin does not offer them a patch, and a shopper buying one used should not read a 2026 headline as coverage.

Samsung's November maintenance release is a different bundle. Malaysian Wireless, reading Samsung's bulletin, says it brings across Google's fixes, including CVE-2026-58868, CVE-2026-58876, CVE-2026-58936, CVE-2026-58882, and adds 24 issues in Samsung's own software. eSecurity Planet, citing SammyGuru, counts the Galaxy package at 206 issues: Android fixes, Samsung Semiconductor items, and those 24 software bugs, among them bootloader, camera-plugin, Contacts, Dialer, Messages and SIM-lock cases. The grand totals do not match. The usable point does. An Android patch date of 2026-11-05 does not say whether Samsung's own 24 fixes were in the file the phone installed.

Read the date string, not the word November. 2026-11-01 is the level tied to the earlier framework and system rows, SMS of Death among them when the bulletin lists it there. 2026-11-05 is the level Google associates with the whole month. On a Galaxy, the model note in Samsung's maintenance list is the only place the extra fixes are itemised. Treating those two strings as one update is how a partial install gets filed as finished.