Android’s November 2026 Update: 29 Security Flaws Worth Your Attention

A permission check that trusts the wrong caller. A profile boundary that fails to protect contact information. A kernel reference that survives after its memory has been freed. Android’s November 2026 disclosures show how very different programming mistakes can undermine the same promise: applications and users should not gain access beyond their authority. Android Security Bulletin

Google published its November bulletin on November 2, 2026, with fixes divided between the 2026-11-01 and 2026-11-05 security patch levels; a separate Android XR bulletin adds an XR-specific framework vulnerability. This article examines the 29 CVEs in the supplied list—not the complete November bulletin—and explains their mechanisms, affected versions, and practical significance. Android bulletin · Android XR bulletin

One finding deserves immediate emphasis: CVE-2026-55275 is rated Critical by Google, even though OpenCVE displays a CVSS score of 8.4, labeled High. Several other entries also contain differences between vendor classifications, database scores, and descriptive text; those disagreements are identified rather than silently resolved. Google bulletin · OpenCVE: CVE-2026-55275

What Matters Immediately

Most of these selected vulnerabilities concern local privilege escalation or information disclosure, while the list also includes a physical USB attack, remote denial of service, and a vulnerability described as remote privilege escalation. These categories are not interchangeable: a local vulnerability with no required victim interaction is not automatically an internet-reachable, zero-click compromise. Google bulletin · FIRST CVSS specification

Reading the ratings: “Google severity” below refers to the Android or Android XR bulletin; “OpenCVE CVSS” refers to the score displayed by OpenCVE when reviewed. Where the official CVE List or NVD carries a conflicting assessment, the difference is explicitly noted. Android bulletin · OpenCVE

The 29 CVEs Explained

CVE-2026-58946: Navigation Permission Bypass

Google severity: High. OpenCVE CVSS: 8.4 High. Affected versions: Android 16, 16 QPR2, and 17. OpenCVE · Official record

CVE-2026-58946 concerns permission enforcement inside navigateUpTo() in ActivityClientController.java; the published description attributes the bypass to a logic error and identifies local privilege escalation without additional execution privileges or victim interaction. The significance is the security boundary around an otherwise ordinary navigation operation, not a newly disclosed network-facing service. Official record

Defensive interpretation: Navigation requests should not inherit more authority than their originating application possesses. Organizations should prioritize the relevant platform update rather than assume that restricting visible app permissions covers this framework-level defect; the public description does not establish unrestricted root access, a complete exploit chain, or a particular malicious application. Those remain separate questions from the confirmed permission-bypass classification. OpenCVE

CVE-2026-58829: FUSE Memory Corruption

Google severity: High. OpenCVE CVSS: 8.4 High. Affected component: Android kernel; device applicability depends on the kernel implementation and patch status. OpenCVE

The vulnerable location is fuse_backing_mmap() in backing.c, where a use-after-free can cause memory corruption and local privilege escalation without additional execution privileges or user interaction. The referenced kernel change replaces manual file-reference manipulation with vma_set_file(), which handles reference management during virtual-memory-area setup. That provides unusually concrete public evidence about the corrective approach. Official record · Kernel change

Defensive interpretation: This is a kernel remediation issue, not something an application update should be assumed to repair. Affected-device identification should use the manufacturer’s firmware information and relevant kernel backports; an Android major-version number alone is insufficient because the CVE identifies the Android kernel rather than enumerating phone models or every affected kernel release. OpenCVE

CVE-2026-49931: Protected Contacts Exposure

Google severity: High. OpenCVE CVSS: 8.4 High. Affected versions: Android 14, 15, 16, 16 QPR2, and 17. OpenCVE

CVE-2026-49931 affects onActivityResult() handling in multiple locations and describes a confused-deputy flaw that can expose contacts from a protected profile without additional execution privileges or victim interaction. Its classifications differ: the CVE description calls the outcome local privilege escalation, while Google’s bulletin categorizes the issue as information disclosure. Both should be preserved when reporting the vulnerability. OpenCVE · Google bulletin

Defensive interpretation: The concrete privacy concern is contact information crossing a boundary intended to protect it. This merits attention on devices separating organizational and personal information, but the disclosure does not justify claiming that every work-profile database is exposed; application-result handling and profile-specific authorization should be included in authorized regression testing after the platform fix is deployed. Official record

CVE-2026-28645: USB Authentication Bypass

Google severity: High. OpenCVE CVSS: 6.8 Medium. Affected versions: Android 15, 16, 16 QPR2, and 17. OpenCVE · Google bulletin

A logic error in onStrongAuthRequiredChanged() in UsbService.java can allow USB data to become enabled without authentication; the official description identifies physical privilege escalation without additional execution privileges or user interaction. The physical attack requirement distinguishes this issue from nearby local-software flaws, while Google’s High severity differs from the CVSS Medium label. Official record

Defensive interpretation: Devices exposed to untrusted physical access deserve particular attention, including shared terminals, travel devices, and equipment handled outside controlled environments. Maintaining physical custody and avoiding untrusted USB connections are sensible interim precautions, but they should not be represented as verified complete mitigations; the authoritative remedy is the applicable security update, followed by checking the device’s patch status. OpenCVE

CVE-2026-49922: Telecom Permission Bypass

Google severity: High. OpenCVE CVSS: 8.4 High. Affected versions: Android 14, 15, 16, and 16 QPR2. OpenCVE

The issue occurs in queryRemoteConnectionServices() in ConnectionServiceWrapper.java, where a confused-deputy condition can bypass permissions and cause local privilege escalation without additional execution privileges or victim interaction. Despite “Remote” appearing in the method name, the published attack classification is local; method names are not evidence of network reachability. Official record

Google also lists this CVE among issues in the Telephonycore Project Mainline component, making the update-delivery channel relevant to remediation checks. Defensive interpretation: Administrators should check both the manufacturer’s security update and applicable Google Play system updates instead of treating either date as interchangeable proof that every November fix is installed. Google bulletin

CVE-2026-58885: Confused-Deputy Permission Bypass

Google severity: High. OpenCVE CVSS: 8.4 High. Affected version: Android 17. OpenCVE

CVE-2026-58885 describes permission bypasses across multiple locations caused by a confused-deputy problem, with local privilege escalation possible without additional execution privileges or user interaction. The public record does not name the affected functions, so the disclosure supports the vulnerability category and prerequisites but not a detailed reconstruction of the vulnerable call sequence. Official record

A confused deputy generally involves a component’s authority being misused on another actor’s behalf. Defensive interpretation: Android 17 deployments should be included in remediation planning even when the public description is brief; inventing an affected service, permission name, or exploit payload would create false precision rather than improve the assessment. MITRE explanation · OpenCVE

CVE-2026-58943: Account-Settings Launch Bypass

Google severity: High. OpenCVE CVSS: 8.4 High. Affected versions: Android 14, 15, 16, 16 QPR2, and 17. OpenCVE

The vulnerable path is run() in AddAccountSettings.java, where a confused-deputy condition can permit a background activity launch and local privilege escalation without additional execution privileges or user interaction. Android’s background-launch restrictions are security controls as well as usability protections, helping prevent unauthorized interruptions and task-related abuse. Official record · Android activity security

Defensive interpretation: A trusted account-settings workflow should not become a route for an untrusted application to obtain otherwise unavailable launch authority. Patch validation should therefore consider the account-addition path, not only direct application launches; however, the disclosure does not say that the flaw itself extracts account passwords or defeats every authentication requirement. OpenCVE

CVE-2026-58944: Task-Fronting Bypass

Google severity: High. OpenCVE CVSS: 8.4 High. Affected versions: Android 14, 15, 16, 16 QPR2, and 17. OpenCVE

CVE-2026-58944 affects moveTaskToFrontLocked() in ActivityTaskManagerService.java and describes a confused-deputy flaw involving background application launch, with local privilege escalation possible without additional execution privileges or victim interaction. This places the vulnerability in task-management behavior rather than a memory-corruption primitive or an explicitly network-facing interface. Official record

Android’s activity-security controls address when applications can display components or bring tasks forward. Defensive interpretation: Remediation testing should distinguish bringing an existing task to the foreground from creating a new activity, since both can affect the user’s interface but follow different paths; a successful fix for one background-launch CVE should not be assumed to cover this separate identifier. Android activity security · OpenCVE

CVE-2025-22426: Cross-User URI Access

Google severity: High. OpenCVE CVSS: 5.9 Medium; the official CVE List/NVD assessment reviewed carries 7.8 High. Affected versions in the updated Android record: 14, 15, 16, 16 QPR2, and 17. OpenCVE · NVD · Google bulletin

The updated description identifies resolveContentProvider() in ComputerEngine.java and a logic error allowing URI access across Android users, potentially producing local privilege escalation without additional execution privileges or victim interaction. This CVE was originally published in June 2026, so its November update should not be described as the first public appearance of a completely new identifier. Official record

Defensive interpretation: Cross-user resource resolution is the important boundary here, especially on shared devices. Security inventories should retain the score’s provider and observation date rather than overwrite one assessment with another; the OpenCVE and NVD values differ, and the accompanying descriptions and vectors should be reviewed alongside the number instead of reducing the decision to “Medium versus High.” OpenCVE · NVD

CVE-2026-55275: Critical Race-Condition Flaw

Google severity: Critical. OpenCVE CVSS: 8.4 High. Affected versions: Android 16, 16 QPR2, and 17. Google bulletin · OpenCVE

CVE-2026-55275 describes a race condition leading to use-after-free across multiple locations and identifies remote privilege escalation without additional execution privileges or user interaction. It is the clearest prioritization exception in this selected set because Google rates the system vulnerability Critical, while the database score remains in the High range. Rapid7 record · Google bulletin

Important uncertainty: The descriptive text says “remote,” but the published CVSS vector uses AV:L, meaning Local. Those statements are in tension, and the reviewed sources do not explain the discrepancy; organizations should prioritize remediation without turning that uncertainty into an unsupported claim of internet-wide root compromise or a confirmed public exploit chain. CVSS assessment · FIRST definitions

CVE-2026-28580: Notification-State Desynchronization

Google severity: High. OpenCVE CVSS: 8.4 High; the official CVE List/NVD assessment reviewed carries 7.8 High. Affected versions: Android 16, 16 QPR2, and 17. OpenCVE · NVD · Google bulletin

An incorrect bounds check in multiple NotificationChannel.java functions can desynchronize persistence and lead to local privilege escalation; the description states that no additional execution privileges or user interaction are needed. Like CVE-2025-22426, this identifier was publicly recorded in June 2026, making its history relevant when distinguishing a revised record from a newly disclosed vulnerability. Official record

Defensive interpretation: The disclosed concern is a mismatch in persisted notification-channel state, not simply an application generating unwanted alerts. Regression testing should consider whether state remains consistent across the transitions addressed by the patch; although some databases associate the issue with bounds-checking weaknesses, the description alone does not establish arbitrary code execution or a complete kernel-compromise mechanism. OpenCVE · INCIBE record

CVE-2026-28586: AppOps Information Disclosure

Google severity: High. OpenCVE CVSS: 4.0 Medium; the official CVE List/NVD assessment reviewed carries 3.3 Low. Affected versions in the updated record: Android 14, 15, 16, 16 QPR2, and 17. OpenCVE · NVD · Google bulletin

The vulnerability affects multiple functions in AppOpsService.java, where missing permission enforcement can produce local information disclosure without additional execution privileges or victim interaction. Its official publication history begins in June 2026, and the current score disagreement includes different privilege assumptions; Google’s bulletin separately assigns High severity. Official record · NVD

Defensive interpretation: This is a strong example of why a database score should not replace the vendor’s remediation guidance. The concrete disclosed outcome is unauthorized information access, so privacy-sensitive deployments should retain it in scope even when a scanner labels it Low or Medium; reporting should also preserve the provider-specific distinction instead of presenting all three ratings as one unified assessment. Google bulletin · OpenCVE

CVE-2026-0053: Cross-User NFC Control

Google severity: High. OpenCVE CVSS: Not available when reviewed. Affected versions: Android 14, 15, 16, 16 QPR2, and 17. Google bulletin · OpenCVE

CVE-2026-0053 describes insufficient isolation between Android users that lets a primary user disable Secure NFC for other full users, potentially causing local privilege escalation without additional execution privileges or victim interaction. The specific relationship matters: the record concerns a primary user influencing another full user’s setting, not an unrestricted claim about every profile type. Official record

Defensive interpretation: Shared-device security depends on settings remaining within their intended administrative boundaries. Testing should therefore include multiple full-user accounts where supported, rather than only a single-user configuration; the absent CVSS score should not be interpreted as absent severity, because Google explicitly lists the vulnerability as High in the November system section. Google bulletin · OpenCVE

CVE-2026-49934: USSD/MMI Validation Failure

Google severity: High. OpenCVE CVSS: Not available when reviewed. Affected versions: Android 14, 15, 16, 16 QPR2, and 17. Google bulletin · OpenCVE

Improper input validation in multiple MmiUtils.java functions creates a risk of USSD/MMI code execution and local privilege escalation without additional execution privileges. Unlike most entries in this selected list, the official description explicitly states that user interaction is required; the vulnerability should therefore not be included in a blanket claim that all 29 issues are interaction-free. Official record

Google lists the issue in the Telephonycore Mainline component. Defensive interpretation: Update checks should include the applicable Google Play system delivery path, while user guidance can discourage interacting with unexpected dialing requests; however, no specific service code, carrier-independent effect, or universal device-reset outcome is established by the reviewed description. Google bulletin · OpenCVE

CVE-2026-49935: Locale Path Traversal

Google severity: High. OpenCVE CVSS: Not available when reviewed. Affected versions: Android 14, 15, 16, 16 QPR2, and 17. Google bulletin · OpenCVE

The vulnerable method is getXmlFileNameForUser() in LocaleManagerService.java; its description identifies a permission bypass involving confusable path traversal and local information disclosure without additional execution privileges or victim interaction. The disclosed outcome is unauthorized reading, not a demonstrated arbitrary-file-write or remote-code-execution capability. Official record

Defensive interpretation: File naming and user-scoped path resolution deserve attention even in services whose visible purpose is language configuration. Authorized testing should focus on the access boundary corrected by the vendor patch; the brief public description does not identify an exact traversal sequence, character-normalization behavior, or set of readable files, so those details should remain unspecified. OpenCVE

CVE-2026-58826: Kernel Unshare Use-After-Free

Google severity: High. OpenCVE CVSS: 8.4 High. Affected component: Android kernel. OpenCVE

CVE-2026-58826 identifies a use-after-free in ksys_unshare() in fork.c, with memory corruption and local privilege escalation possible without additional execution privileges or user interaction. Google places the issue under Direct Memory Access Buffer, and the referenced changes discuss per-process DMA-buffer accounting and stale buffer references, adding context beyond the named function. Official record · Kernel change

Defensive interpretation: The accounting context matters because the function name alone does not describe the entire lifetime-management problem. Device vendors and kernel maintainers should verify the relevant backports across their supported branches; users should rely on the applicable firmware update rather than infer protection from application permissions, a recent app-store update, or the Android release number alone. Google bulletin · OpenCVE

CVE-2026-58827: DMA-Buffer Race Condition

Google severity: High. OpenCVE CVSS: 8.4 High. Affected component: Android kernel. OpenCVE

A race condition in multiple dma-buf.c functions can lead to use-after-free and local privilege escalation without additional execution privileges or user interaction. The referenced kernel change explains how copied accounting information can include DMA-buffer references that do not actually propagate to a child process, potentially leaving references to freed buffers. Official record · Kernel change

The change rebuilds the child’s accounting from its actual memory and file references rather than relying on a copied parent accounting structure. Defensive interpretation: This supports testing process-creation and buffer-lifetime behavior together, while keeping the CVE separate from CVE-2026-58826; related subsystems and similar consequences do not mean two independently assigned vulnerabilities have identical fixes. Kernel change

CVE-2026-58837: Background-Launch Logic Error

Google severity: High. OpenCVE CVSS: 8.4 High. Affected versions: Android 14, 15, 16, 16 QPR2, and 17. OpenCVE

CVE-2026-58837 describes a background activity launch vulnerability across multiple locations caused by a logic error, with local privilege escalation possible without additional execution privileges or victim interaction. The record does not name the individual functions, distinguishing the level of available detail from the more specifically documented task-management and account-settings entries. Official record

Defensive interpretation: This belongs in a broader review of background-launch restrictions, but it should not be collapsed into another CVE merely because the outward behavior sounds similar. Android’s activity-security model contains several routes and exceptions, making it important to verify the applicable fixes individually rather than declare the entire category resolved after one successful UI test. Android activity security · OpenCVE

CVE-2025-22436: Autofill Overlay Exposure

Google severity: High. OpenCVE CVSS: Not available when reviewed. Affected versions: Android 14 and 15. Google bulletin · OpenCVE

The description concerns Autofill contents being disclosed through tapjacking or overlay-based deception and calls the outcome local privilege escalation; Google instead lists the vulnerability as information disclosure. There is another important tension: the text refers to tricking a user, yet states that user interaction is not required for exploitation. The record does not explain that combination. Official record · Google bulletin

Defensive interpretation: Reporting should retain the uncertainty instead of confidently labeling this a fully explained zero-click password-theft attack. The supported concern is an Autofill confidentiality boundary involving misleading UI; administrators should prioritize the applicable Android 14 and 15 fixes and evaluate overlay-related controls as additional precautions, not as a proven substitute for the patch. OpenCVE

CVE-2026-28632: Cross-Profile File Disclosure

Google severity: High. OpenCVE CVSS: Not available when reviewed. Affected versions: Android 14, 15, 16, and 16 QPR2. Google bulletin · Official record

CVE-2026-28632 describes logic errors across multiple locations that can allow files to be shared across profiles, leading to local information disclosure without additional execution privileges or victim interaction. The public description identifies the boundary failure but does not enumerate file types, named applications, or a universal ability to read every protected-profile resource. Official record

Defensive interpretation: Organizations using profile separation should include this issue in confidentiality-focused remediation, alongside the protected-contact disclosure. Regression tests should distinguish intentionally permitted cross-profile sharing from transfers that should be blocked by policy; treating all cross-profile communication as either automatically safe or automatically malicious would miss the authorization decision at the center of this vulnerability. OpenCVE

CVE-2026-45514: Save-UI Requirement Bypass

Google severity: High. OpenCVE CVSS: 8.4 High. Affected versions: Android 14, 15, 16, 16 QPR2, and 17. OpenCVE

The issue affects multiple SaveUi.java functions and describes a logic error that can bypass package-installation requirements, causing local privilege escalation without additional execution privileges or victim interaction. That is a more specific claim than saying an attacker can install any package silently, and the reviewed description does not establish such an unrestricted installation capability. Official record

Defensive interpretation: A UI-mediated operation should not weaken requirements attached to the underlying privileged action. Patch validation should therefore examine the relevant save-interface flow and its authorization checks, while operational reporting should avoid confusing the filename with proof that stored credentials are exposed; the publicly stated mechanism concerns installation requirements, not a separately established password-data leak. OpenCVE

CVE-2026-55262: Notification-Policy Desynchronization

Google severity: High. OpenCVE CVSS: 8.4 High. Affected versions: Android 14, 15, 16, 16 QPR2, and 17. OpenCVE

CVE-2026-55262 affects setNotificationListenerAccessGrantedForUserInternal() in NotificationManagerService.java, where improper input validation can desynchronize policy and cause local privilege escalation without additional execution privileges or victim interaction. The method’s user-specific authorization role makes the consistency of the policy decision central to understanding the disclosed defect. Official record

Defensive interpretation: An administrative view of a setting should not be assumed to prove that every enforcement path shares the same state. Organizations should review notification-listener access as part of authorized post-update validation, but unexpected settings alone are not a CVE-specific indicator of exploitation; the public advisory provides neither a universal detection signature nor a complete attack sequence. OpenCVE

CVE-2026-58836: Sideloading Safeguard Bypass

Google severity: High. OpenCVE CVSS: 7.8 High. Affected versions: Android 16, 16 QPR2, and 17. OpenCVE

The vulnerable path is handlePackagePostInstall() in InstallPackageHelper.java; a logic error lets a sideloaded application modify its package source during self-update, bypassing Enhanced Confirmation Mode protections. Unlike the many “no additional execution privileges” entries, this record specifies User execution privileges, while still stating that victim interaction is not required for exploitation. Official record

Defensive interpretation: Installation provenance is a security-relevant input, so its treatment across an update deserves scrutiny rather than being considered harmless metadata. Until patched, organizations can reduce exposure by restricting unnecessary sideloading and reviewing approved installation channels; these are risk-reduction recommendations, not evidence that every self-updating sideloaded application is malicious or that the flaw enables remote initial installation. OpenCVE

CVE-2026-58853: Printing-Component Overflow

Google severity: High. OpenCVE CVSS: 7.5 High. Affected versions: Android 14, 15, 16, 16 QPR2, and 17. OpenCVE

CVE-2026-58853 describes a missing bounds check in multiple ipphelper.c functions and an apparent stack-buffer-overflow condition, with remote denial of service possible without additional execution privileges or victim interaction. The source description contains the typo “stack bugger overflow”; that wording is not a distinct vulnerability category. Official record

Important discrepancy: Google’s bulletin labels this entry EoP, while the CVE narrative and CVSS assessment support a remote availability impact. Defensive interpretation: Prioritize the affected update and investigate printing exposure where relevant, but do not transform a documented denial-of-service description into an established remote-code-execution claim; the reviewed sources do not demonstrate that stronger outcome. Google bulletin · OpenCVE

CVE-2026-58866: Accessibility UI Trust Failure

Google severity: High. OpenCVE CVSS: 8.4 High. Affected versions: Android 14, 15, 16, 16 QPR2, and 17. OpenCVE

The vulnerability occurs in setAccessibilityWindowAttributes() in AccessibilityWindowManager.java, where a missing permission check can produce untrusted or misleading UI and local privilege escalation without additional execution privileges or victim interaction. The disclosed failure concerns authority over window attributes, not a demonstrated compromise of every accessibility feature or service. Official record

Defensive interpretation: Security-sensitive interfaces depend on applications being unable to misrepresent their authority through protected UI paths. Testing should focus on the authorization boundary restored by the update, while avoiding the overbroad recommendation to disable all accessibility functionality; the CVE does not establish that removing legitimate accessibility services completely mitigates this framework permission defect. OpenCVE

CVE-2026-58970: App-Time Launch Bypass

Google severity: High. OpenCVE CVSS: 8.4 High. Affected versions: Android 14, 15, 16, 16 QPR2, and 17. OpenCVE

CVE-2026-58970 affects deliverResult() in AppTimeTracker.java, where a confused-deputy condition can enable a background activity launch and local privilege escalation without additional execution privileges or victim interaction. It is another example of a privileged result-delivery path becoming security-relevant, even though the visible component concerns application-time tracking rather than an obvious installation or authentication feature. Official record

Defensive interpretation: Result callbacks and delegated actions deserve the same caller-authority scrutiny as direct launches. Organizations should track this as a separate fix from the account-settings and task-fronting vulnerabilities; Android’s launch restrictions cover multiple situations, and shared terminology does not prove that patching one intermediary repairs every other path carrying background-launch authority. Android activity security · OpenCVE

CVE-2026-58873: Android XR Listener Bypass

Google severity: High. OpenCVE CVSS: 8.4 High. Affected product: Android XR; the bulletin lists AOSP version 14. Android XR bulletin · OpenCVE

The vulnerable method is addDragDropListener() in WindowManagerService.java, where a missing permission check can allow local privilege escalation without additional execution privileges or victim interaction. Product scope is important: Google publishes this entry in the Android XR bulletin, so it should not automatically be presented as affecting every conventional Android 14 handset. Official record

The XR bulletin says a complete update includes its additional issue together with the applicable November Android fixes at security patch level 2026-11-05 or later. Defensive interpretation: XR administrators should verify supplier firmware and XR-specific coverage rather than infer complete remediation from a generic Android update notice or a similarly named smartphone vulnerability. Android XR bulletin

CVE-2026-58985: Trusty RPC Denial-of-Service

Google severity: High. OpenCVE CVSS: Not available when reviewed. Affected versions: Android 16 QPR2 and 17. Google bulletin · OpenCVE

CVE-2026-58985 identifies a logic error in handleConnectInternal() in RpcServerTrusty.cpp that can produce local denial of service without additional execution privileges or victim interaction. The disclosed outcome is disruption, not a confirmed confidentiality breach or privilege-escalation primitive; the naming of a trusted component does not itself establish a broader compromise. Official record

Defensive interpretation: Availability issues deserve operational attention where devices support important workflows, even when no CVSS score has yet appeared in the database. Validation should follow the vendor’s affected-version and patch guidance; the short public description does not establish whether the disruption affects a service, a broader device function, or a particular recovery sequence across all products. OpenCVE

CVE-2026-58989: Factory-Reset Protection Bypass

Google severity: High. OpenCVE CVSS: Not available when reviewed. Affected versions: Android 15, 16, and 16 QPR2. Google bulletin · OpenCVE

A missing permission check in setOemUnlockAllowedByUser() in OemLockService.java can allow Factory Reset Protection to be bypassed, resulting in local privilege escalation without additional execution privileges or victim interaction. Factory-reset device protection is intended to prevent unauthorized reuse after erasure, making this a device-ownership control rather than simply another application-permission setting. Official record · Google device-protection guidance

Defensive interpretation: Fleets that depend on anti-theft and ownership protections should include this issue in their patch priorities. The disclosed FRP bypass should not be conflated with recovery of previously encrypted user files, a universal bootloader-unlock method, or a demonstrated remote attack; those stronger claims are not established by the public description reviewed here. OpenCVE

Why Ratings Differ

The November records demonstrate three separate reporting dimensions: Google’s platform severity, a CVSS assessment supplied by an authorized publisher, and the score displayed by an aggregator. Differences can also involve vulnerability type and attack prerequisites, so copying a single severity column loses important context. Google bulletin · NVD example

Which Patch Level Matters?

Google’s November bulletin states that 2026-11-05 or later addresses all applicable issues in the bulletin, while 2026-11-01 covers the issues assigned to that earlier level and previous required fixes. The three kernel CVEs discussed here appear in the 2026-11-05 section, so a November 1 patch label should not automatically be treated as evidence that those kernel fixes are included. Google bulletin

Google also identifies Mainline components for some vulnerabilities, including Telephonycore coverage for CVE-2026-49922 and CVE-2026-49934. Android security updates and Google Play system updates therefore need to be checked separately; their dates describe different update status information and should not be substituted for one another. Google bulletin · Android update guidance

What Users Should Do

1. Check the installed security date. Open Settings, then About phone or About tablet, and inspect Android version, Android security update, Google Play system update, and build information. Menu labels can vary by device. Google instructions

2. Install available system updates. Check System → Software updates, follow the manufacturer’s instructions, and complete any required restart. A published bulletin does not mean every device has already received its corresponding firmware. Google instructions

3. Check Google Play system updates separately. Do not assume that a recent Play system date replaces the applicable manufacturer-delivered kernel or platform update. Google bulletin

4. Verify XR-specific coverage. Android XR owners and administrators should consult their supplier’s firmware information as well as the dedicated XR bulletin. Android XR bulletin

Enterprise Validation Priorities

Recommended workflow: Inventory device models, builds, Android security dates, Play system dates, and supported update channels; then map applicable CVEs to the manufacturer’s remediation evidence. Prioritize CVE-2026-55275, affected kernel builds, and devices whose actual use makes profile separation, physical access, or installation provenance especially important.

Use authorized regression tests for profile isolation, activity-launch restrictions, notification-policy consistency, and relevant multi-user settings. Treat unexpected behavior as an investigation lead rather than a CVE-specific detection signature, and avoid running untrusted exploit tools on production devices.

Frequently Asked Questions

Are These All Zero-Click?

No. CVE-2026-49934 explicitly requires user interaction, and CVE-2026-28645 requires a physical attack path; most other selected descriptions state that victim interaction is unnecessary, but that does not make every vulnerability remotely reachable. USSD/MMI record · USB record · FIRST definitions

Does N/A Mean Low Risk?

No. Several selected entries lack an OpenCVE CVSS score while Google rates them High, including the cross-user Secure NFC issue and the FRP bypass. A missing numerical assessment is an information gap, not a finding that exploitation would be harmless. Google bulletin · NFC record · FRP record

Are Older Android Versions Safe?

The listed affected versions should not be generalized into a guarantee about every older or unsupported release. The records and bulletin provide specific product/version information; determining whether an individual older device is protected requires its vendor’s support and patch information rather than an assumption based on absence from this selected list. Android bulletin guidance

Are These Confirmed Active Attacks?

The vulnerability descriptions reviewed for this article do not, by themselves, establish that these 29 CVEs are being exploited in an active campaign. A published vulnerability, an available fix, a proof of concept, and confirmed real-world exploitation are different claims; none should be substituted for another without specific supporting evidence.

Why Include 2025 Identifiers?

The year embedded in a CVE identifier is not necessarily its public-disclosure year, and a database update is not necessarily its initial publication. In this selection, CVE-2025-22426 has a June 2026 publication history, while CVE-2025-22436 was published in November 2026; both appear in Google’s November bulletin. CVE-2025-22426 · CVE-2025-22436

---

Publication note: This article reflects records reviewed on November 3, 2026. Scores, descriptions, affected-version lists, and advisory links can change as publishers revise or enrich their records; operational decisions should use the latest applicable vendor information.