Android November 2026 Security Bulletin: Critical Fixes

Google published the Android November 2026 Security Bulletin on November 2, 2026, patching more than 200 security vulnerabilities across core OS components, the Linux kernel, and vendor hardware. At the top of the list are 23 critical-severity flaws.

Three of those are zero-click remote code execution (RCE) vulnerabilities (CVE-2026-58868, CVE-2026-58876, and CVE-2026-58936) that let attackers run code without a single tap from the user or any extra execution privileges. The release also formally documents CVE-2026-58882, a critical “SMS of Death” denial-of-service bug that can silently drop active voice and emergency calls.

Software patches were only half the story this month. On the same day, the Google Threat Intelligence Group (GTIG) announced the takedown of the x.cpe botnet (also tracked as XCPE).

This supply-chain operation compromised more than 1.3 million Android TV set-top boxes, telehealth terminals, and digital signage units through a firmware backdoor planted on the assembly line by Shenzhen-based OEM Videostrong Technology Co.

Here is what security teams need to know about the November patches, how the firmware botnet operated, and what actions to take right now.

Quick Answer

The Android November 2026 Security Bulletin patches over 200 vulnerabilities across the 2026-11-01 and 2026-11-05 patch levels, including three critical zero-click RCE flaws (CVE-2026-58868, CVE-2026-58876, and CVE-2026-58936) and the CVE-2026-58882 telephony denial-of-service bug across Android 14 through 17. At the same time, Google dismantled C2 infrastructure for the 1.3-million-device x.cpe botnet attributed to Android TV manufacturer Videostrong.

What Happened: Summary of Confirmed Actions

Google’s first week of November 2026 brought two major defensive interventions across the Android ecosystem: a massive monthly OS patch drop and a coordinated international botnet disruption. To keep the operational picture clear, the breakdown below separates confirmed primary facts from threat intelligence assessments.

• Confirmed by Google (Android Security Bulletin): The Android November 2026 Security Bulletin divides fixes across two security patch levels (2026-11-01 and 2026-11-05). It resolves 23 critical vulnerabilities and more than 150 high-severity flaws affecting Android 14, 15, 16, 16-QPR2, and 17. Google has not reported active in-the-wild exploitation for any of the newly patched November CVEs in this bulletin.

• Confirmed by Google Threat Intelligence Group (GTIG): On November 2, 2026, Google worked with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI to seize domains and dismantle command-and-control (C2) servers powering the x.cpe botnet. Google permanently banned Videostrong Technology Co. and its subsidiaries from building or supplying software for certified Android devices. The C2 takedown also disrupted infrastructure tied to more than a dozen malware families affecting an estimated 10 million additional devices worldwide.

• Assessed with High Confidence: GTIG attributes the creation and pre-installation of the x.cpe backdoor with high confidence directly to Videostrong Technology Co., rather than an outside third-party intrusion into their build pipeline.

Android November 2026 Security Bulletin Breakdown

Google splits its monthly updates into two separate patch levels. This setup lets Original Equipment Manufacturers (OEMs) push core OS fixes quickly while taking the time needed to test hardware-specific drivers. Any device updated to a security patch level of 2026-11-05 or later includes all fixes from both levels.

Note: Google’s bulletin rates severity using the Android Security Rewards severity scale rather than listing individual numeric Common Vulnerability Scoring System (CVSS) scores or Common Weakness Enumeration (CWE) identifiers for every table entry.

2026-11-01 Security Patch Level

The 2026-11-01 patch level targets core Android Open Source Project (AOSP) components: Android Runtime, Framework, System, and Google Play system updates. Within the Android Runtime component, the most serious bug is CVE-2026-58988 (tracked as A-269456968). It is a high-severity local information disclosure vulnerability that triggers without user interaction or elevated execution privileges.

2026-11-05 Security Patch Level

The 2026-11-05 security patch level addresses vulnerabilities in the Linux kernel and closed-source vendor components from Qualcomm, MediaTek, Arm, Imagination Technologies, and Unisoc. Downstream OEMs fold these patches into their own monthly Maintenance Releases.

For example, Samsung’s November 2026 Security Maintenance Release (SMR) packages 178 AOSP fixes (20 critical, 157 high, 1 moderate) alongside 24 One UI-specific patches.

Technical Analysis: Zero-Click RCEs and CVE-2026-58882

What makes the Android November 2026 Security Bulletin so urgent for enterprise defenders is the cluster of vulnerabilities in the Framework and System components that require zero user interaction.

Zero-Click Remote Code Execution (RCE) Flaws

In Android’s architecture, the Framework component supplies essential application APIs and manages core app lifecycles. Meanwhile, the System component handles privileged native daemons, connectivity stacks, and media processing.

The standout flaw in the Framework section is CVE-2026-58868 (A-486464711). According to Google’s advisory, CVE-2026-58868 lets a remote attacker run arbitrary code inside a privileged process without user interaction or additional execution privileges.

Why this matters: because an attacker can reach this vulnerability remotely without tricking a user into tapping a link or opening a file, it is an ideal vector for silent compromise over network or messaging channels.

In the System component, Google patched two more critical zero-click RCE vulnerabilities: CVE-2026-58876 (A-503543341) and CVE-2026-58936 (A-496614216). Both bugs impact Android versions 14, 15, 16, 16-QPR2, and 17. Still, there is a silver lining for defenders tracking CVE-2026-58876.

Google is pushing its fix through Project Mainline (Google Play system updates) inside the Media Codecs module, meaning supported devices on Android 10 and later can get modular protection before their hardware OEM ships a full firmware update.

CVE-2026-58882: The “SMS of Death” Telephony DoS

The 2026-11-01 patch level also formally documents CVE-2026-58882, a critical System denial-of-service flaw uncovered by independent security researcher Mark Blaszczyk. Reported to Google on May 5, 2026, and made public on October 29, 2026, the bug sits inside Android’s core telephony framework (WapPushOverSms.java).

Here is how the failure plays out in practice. When an Android phone receives a Wireless Application Protocol (WAP) Push SMS message, the telephony stack parses the binary header automatically before deciding whether to hand the payload off to an app. Because of an unchecked integer conversion in WapPushOverSms.java, a crafted WAP Push header length can be read as a negative integer.

When the system tries to allocate memory using that negative number, it throws an unhandled runtime exception and crashes the com.android.phone process.

Because that crash happens down at the baseband-to-OS telephony layer, it creates three immediate operational headaches:

1. Zero User Interaction: The target never has to open a message, and no notification or inbox entry ever shows up on the screen.

2. Sender Anonymity: The crash stops the OS from logging or showing the attacker’s phone number.

3. Call Disruption & Crash Loops: Killing com.android.phone instantly drops active cellular voice calls, including emergency calls. Worse yet, queued or repeated WAP Push messages can lock the phone into a nonstop crash and reboot loop.

Google started rolling out code fixes for CVE-2026-58882 during the October 2026 update cycle, and its formal inclusion in the Android November 2026 Security Bulletin locks in enforcement across all AOSP builds from Android 14 through 17. With a public proof-of-concept (PoC) already circulating online, unpatched devices face an immediate risk.

Inside the x.cpe Botnet: Videostrong’s Firmware Backdoor

Monthly security bulletins fix software mistakes in legitimate OS components. Google’s takedown of the x.cpe botnet, however, deals with a much harder problem: intentional hardware supply-chain compromise by the device manufacturer itself.

Supply-Chain Implant in /oem/

According to the Google Threat Intelligence Group, Shenzhen-based OEM Videostrong Technology Co. baked the backdoor components (x.cpe and com.oemservice) straight into the /oem/ partition of its Android device firmware on the factory floor.

Here is the catch for IT teams: the /oem/ partition is read-only during normal use and survives standard user data wipes. Performing a factory reset on an infected unit will not remove the malware. More than 1.3 million devices joined the botnet the moment they were plugged in out of the box.

While most of these units were cheap, off-brand Android TV set-top boxes (many running Videostrong’s YokaTV Player software), GTIG also found the implant inside enterprise digital signage displays, karaoke machines, and telehealth terminals.

Two-Stage C2 and MQTT Architecture

The moment an infected device goes online, the x.cpe botnet runs a multi-stage communication and persistence routine that maps cleanly to the MITRE ATT&CK framework:

1. Supply Chain Compromise (T1195.003): The device boots up with x.cpe and com.oemservice running with elevated system privileges out of the /oem/ partition. The malware filters system calls to block thread termination, stop child process interference, and hide from standard endpoint tools.

2. Stage 1 HTTP C2 (T1071.001): The implant fires off initial HTTP POST requests to operator-controlled servers to pull down dynamic configuration parameters, geolocation data, and Session Traversal Utilities for NAT (STUN) settings.

3. Stage 2 Persistent MQTT C2 (T1071): Next, the backdoor opens a persistent, real-time connection over the Message Queuing Telemetry Transport (MQTT) protocol using non-standard TCP ports 3885, 3886, and 3887. Once registered, the device receives an ext/lib/config payload that sets resource limits and assigns plugin tasks.

4. Dynamic Payload Staging (T1105): Directed by the MQTT broker, a downloader module called “Nexus” builds OkHttp requests to fetch native Executable and Linkable Format (ELF) binaries, shell scripts, and secondary APKs. Many of these payloads were hosted as releases on operator-controlled GitHub pages and silently installed through the system package manager.

Monetization Modules and Spyware Capabilities

Videostrong cashed in on the x.cpe botnet by renting access to criminal affiliates, turning home and office networks into steady revenue streams across three main operations:

• Residential Proxy Exit Nodes (T1090): Modules like Linkfog, AppSalt, NetNut, and Traffmonetizer turned infected Android TV boxes into residential proxy relays. This let outside threat actors route malicious traffic straight through victims’ residential and corporate IP addresses.

• Hidden WebView Ad Fraud: Modules including CBOXTV and HiddenView spun up transparent background window overlays and hidden WebViews to load target websites, play media on mute, and fake human scrolling, clicking, and typing.

• Secondary Backdoors and Espionage: Other loaders (Moyu, Spirit) established deeper persistence. At the same time, GTIG watched Videostrong operators take live screenshots, inject keystrokes, run arbitrary shell commands, and steal account credentials, package inventories, and system logs.

CyberInfos Analyst Insight: Enterprise & India Implications

CyberInfos Analysis: The collision of zero-click RCEs (CVE-2026-58868) and the x.cpe botnet highlights a dangerous blind spot in enterprise mobile and IoT security. Companies spend heavily to lock down employee smartphones with Mobile Device Management (MDM) policies, yet they routinely ignore unmanaged Android peripherals plugged into their own office networks.

From a defensive standpoint, two strategic risks stand out for security leaders and Indian enterprises:

1. Shadow Android IoT in Corporate Environments

Few companies buy budget Android TV boxes for desk work. Yet Videostrong-built hardware slips into offices all the time as conference room wireless casting boxes, lobby digital signage players, or remote telehealth kiosks.

What this means for network defenders is simple: if an x.cpe-infected box connects to a poorly segmented office Wi-Fi network, its residential proxy modules (Linkfog, NetNut) create a direct bridge for external criminal traffic inside the corporate perimeter, bypassing edge firewalls and breaking east-west traffic rules.

2. Regulatory Exposure in India (CERT-In & DPDP Act)

Across India, low-cost uncertified Android TV streaming boxes and commercial signage displays are imported in bulk and rebranded by local vendors. Under the Indian Computer Emergency Response Team (CERT-In) Cyber Security Directions of April 2022, organizations must report unauthorized access to IT systems, compromise of critical infrastructure, and targeted scanning or malicious code activity within 6 hours of detection.

If a compromised signage player or telehealth terminal leaks system logs or acts as a proxy relay for attacks against other organizations, Indian businesses face strict mandatory reporting deadlines.

Beyond CERT-In rules, allowing unpatched corporate phones or backdoored telehealth kiosks to expose personal data through known bugs like CVE-2026-58868 puts data fiduciaries at risk of heavy financial penalties for failing to maintain reasonable security safeguards under India’s Digital Personal Data Protection (DPDP) Act, 2023.

Detection, Mitigation, and Remediation Guidance

Software vulnerabilities and factory-installed firmware backdoors demand completely different playbooks. Security teams should split their response into two parallel tracks: immediate patching for mobile fleets, and network hunting plus hardware removal for IoT peripherals.

Track 1: Remediating November 2026 Android Vulnerabilities

1. Deploy Patch Level 2026-11-05: Roll out the Android November 2026 Security Bulletin updates across all managed phones and tablets through enterprise MDM/UEM platforms like Microsoft Intune or Google Endpoint Management.

2. Enforce Project Mainline Updates: Make sure managed devices can pull Google Play system updates so the Media Codecs patch for CVE-2026-58876 lands right away, even if the phone maker takes weeks to deliver a full firmware image.

3. Retire End-of-Life (EoL) Devices: CVE-2026-58882 also impacts Android 12 and 13, which no longer get standard AOSP backports from Google. Any device stuck on Android 13 or older that cannot upgrade to Android 14+ should be rotated out of executive or on-call duties where a telephony DoS attack could cut off critical communications.

Track 2: Detecting and Isolating x.cpe Hardware

1. Monitor Non-Standard MQTT Egress: Set up firewall, Intrusion Detection System (IDS), and SIEM rules to alert on outbound TCP connections over ports 3885, 3886, and 3887, the exact ports x.cpe uses for MQTT C2 traffic.

2. Inspect Partition Integrity: On questionable Android TV, digital signage, or kiosk hardware, connect via Android Debug Bridge (adb) to check installed system packages (adb shell pm list packages -f). Flag any unit that shows x.cpe or com.oemservice sitting inside the /oem/ partition.

3. Hardware Replacement (Permanent Remediation): Because the backdoor lives inside the read-only /oem/ firmware image, factory resets will not clean the hardware. Pull uncertified Android TV boxes off the network permanently and replace them with Google Play Protect certified devices. If you cannot swap a unit out today, quarantine it on a tightly firewalled guest VLAN with zero routing to internal corporate subnets.

Enterprise Security & Patch Verification Checklist

Use this interactive tracker to manage your organization’s response to the November 2026 Android updates and the x.cpe supply-chain threat:

• Audit MDM fleet for Android versions 14 through 17: Identify devices vulnerable to CVE-2026-58868, CVE-2026-58876, and CVE-2026-58936.

• Enforce 2026-11-05 security patch level across managed endpoints: Verify compliance in Settings -> About Phone -> Android Version -> Security Update.

• Verify Google Play system updates (Project Mainline): Confirm Media Codecs update is applied to mitigate CVE-2026-58876.

• Hunt for outbound MQTT traffic on TCP ports 3885 to 3887: Check firewall and proxy logs for persistent C2 connections from IoT subnets.

• Audit conference room Android TV boxes, signage, and telehealth kiosks: Inspect /oem/ partition for x.cpe and com.oemservice packages or decommission uncertified boxes.

• Enforce Play Protect Certification in hardware procurement policies: Ban uncertified off-brand Android IoT devices and document findings for CERT-In audit readiness.

Frequently Asked Questions (FAQ)

What are the most critical flaws in the Android November 2026 Security Bulletin?

The most severe vulnerabilities in the Android November 2026 Security Bulletin are CVE-2026-58868 (in the Framework component) and CVE-2026-58876 and CVE-2026-58936 (in the System component). All three are critical zero-click remote code execution flaws affecting Android 14 through 17 that let attackers run arbitrary code without user interaction.

How does the CVE-2026-58882 “SMS of Death” vulnerability work?

CVE-2026-58882 is a critical denial-of-service vulnerability in Android’s WapPushOverSms.java telephony component. A malformed WAP Push SMS triggers an unchecked integer conversion that produces a negative header length, crashing the com.android.phone process. It silently drops active calls, including emergency calls, without showing a message in the user’s inbox.

Can a factory reset remove the x.cpe botnet from an infected Android TV box?

No. Videostrong Technology Co. embedded the x.cpe and com.oemservice backdoor files directly into the read-only /oem/ firmware partition during manufacturing. Because factory resets only wipe the /data/ and /cache/ partitions, the malware automatically reinstalls and reconnects to C2 infrastructure after a reset. Affected devices must be replaced.

What is the difference between the 2026-11-01 and 2026-11-05 security patch levels?

The 2026-11-01 patch level addresses core Android Open Source Project (AOSP) vulnerabilities across the Android Runtime, Framework, and System components. The 2026-11-05 patch level includes all 2026-11-01 fixes plus patches for the Linux kernel and proprietary hardware components from vendors such as Qualcomm,  MediaTek, and Arm.

Final Thoughts

The Android November 2026 Security Bulletin and the takedown of the x.cpe botnet highlight two very different sides of Android security. On one side, IT teams have to patch critical software bugs like CVE-2026-58868, CVE-2026-58876, CVE-2026-58936, and CVE-2026-58882 before attackers weaponize zero-click RCE and telephony denial-of-service flaws.

On the other side, defenders have to accept a hard truth: no software patch can fix a device that was intentionally backdoored at the factory. Security teams should enforce the 2026-11-05 patch level across all managed mobile endpoints immediately, then sweep corporate networks to root out uncertified Android IoT hardware.