Osegi
Security·2 min read

Android November Update Fixes 216 Flaws, Including Zero-Click Bug

Google's November Android patch closes 216 vulnerabilities, 23 of them critical, including a Framework flaw that allows remote code execution with no user interaction.

A smartphone showing an Android security update screen with a warning shield icon.
Image: 01net.com
SUMODialoediviewergiftdetect

Google has released its November security update for Android, fixing 216 vulnerabilities, 23 of which are rated critical. The most serious one lets an attacker take control of a phone remotely, without the owner clicking or tapping anything.

The flaw sits in the Framework, one of Android's core components. In its security bulletin, Google says the most severe issue is a critical Framework vulnerability that could lead to remote code execution without additional execution privileges, and that no user interaction is needed to exploit it. According to the report, the bug lies in the code that generates previews of photos and videos, such as the thumbnails shown in a gallery. An attacker could run malicious code without the victim opening a link or downloading anything. Android 14 through Android 17 are all affected.

Why the clock is ticking

There is currently no evidence that criminals have exploited the vulnerability. That could change quickly: as is Google's habit, the source code of the fixes becomes public 48 hours after the bulletin, which gives attackers a chance to study the patch and work out how to abuse the hole.

Not every phone will be protected. According to Android distribution data, more than 40% of active devices still run Android 13 or older. Those versions are considered obsolete and no longer receive security updates from Google, leaving their owners exposed. For supported devices, the timing depends on the manufacturer, which must adapt the fix to its own Android interface. Some roll it out within days, others take several weeks.

How to check your phone

Open Settings, go to About phone, then Android version, and look at the Android security update date. If it reads November 1, 2026 or later, your device is protected against the critical flaw. If an update is available, install it right away. Owners of phones that no longer receive any updates should consider replacing them.

Apps worth a look

SUMO: the number puzzle

Tap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.

Tags:androidgooglesecurity patchzero-clickvulnerabilitynovember 2026

More from this day

See all →

More in: Security

See all →