Update your phone and browser today: Android’s November patch fixes 200+ flaws and Chrome 157 fixes 213
Google's November Android update fixes more than 200 vulnerabilities, including a critical flaw that needs no user interaction, and Chrome 157 patches 213 bugs. Here's how to update both.
Two big security updates have just landed, and both are worth installing today. Google’s November 2026 Android update fixes more than 200 vulnerabilities, and Chrome 157 patches 213 more. Neither is reported as exploited yet, but updating early is the best protection. Here is what is fixed and how to update.
Android’s November 2026 update
Google announced the update on Monday, November 2. It comes in two parts:
- 2026-11-01 patch level: fixes 119 flaws in the Android runtime, Framework and System. Framework got 65 fixes and System 53. Seventeen of these flaws were already fixed earlier through Google Play system updates.
- 2026-11-05 patch level: fixes 97 more bugs in the Kernel and in chip components from Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm. More than a dozen are critical and affect areas such as Bluetooth, pKVM, HID, a MediaTek modem and a closed-source Qualcomm component.
The most serious bug is CVE-2026-58868 in the Framework. Google says it could lead to remote code execution with no extra privileges, and that user interaction is not needed to exploit it. Critical flaws in the System component were fixed too. Google also released updates for Android XR and Wear OS.
Google says phones with a security patch level of 2026-11-05 or later have all of these fixes.
Chrome 157
Google released Chrome 157 to the stable channel on November 4 with fixes for 213 vulnerabilities, including seven critical and 77 high-severity bugs. The top issue is a buffer overflow in Dawn, the open source implementation of the WebGPU standard, for which the reporting researcher earned a $10,000 reward. The most common problem types were incorrect or missing authorization (51 fixes) and use-after-free (45 fixes).
Google does not say any of these flaws are being exploited in the wild, but advises everyone to update. The new versions are 157.0.8103.38 or .39 for Windows and macOS and 157.0.8103.38 for Linux.
How to update Android
- Open Settings and search for Security update or System update. The exact menu varies by phone maker.
- Check the Android security update date. You want November 5, 2026 or later.
- Tap Check for update and install anything available, then restart.
- Also open the Google Play system update entry and update it.
Pixel phones usually get updates first. Samsung, Xiaomi and other brands may take days or weeks, depending on your model and carrier, so don’t worry if it is not there yet. Check again regularly.
How to update Chrome
- Open Chrome and go to Menu > Help > About Google Chrome on a computer, or open Chrome’s page in the Play Store or App Store on a phone.
- Chrome will check for updates and download version 157.
- Click Relaunch when prompted. The update only protects you after a restart.
What about older phones?
If your Android phone no longer receives security updates, you can’t get these fixes, and the risk grows over time. Consider replacing it, and avoid sensitive tasks such as banking on an unsupported device. This matters because attackers regularly target known, already-fixed flaws on unpatched phones, as we saw in the APT29 attacks on iPhones and Android phones. iPhone owners should check our guide to iOS 27.2.
Remember that phones can be pricey to replace right now because of the memory shortage, so check your options before buying.
Quick safety habits
- Turn on automatic updates for Android, Chrome and your apps.
- Install apps only from the official store.
- Be careful with links in messages, even from people you know.
Frequently asked questions
What is the Android security patch level to look for?
November 5, 2026 (2026-11-05) or later has all the fixes from this month’s update.
How serious is the Android Framework bug?
CVE-2026-58868 is rated critical. Google says it could allow remote code execution without user interaction, but it has not reported attacks using it.
Is Chrome 157 being attacked in the wild?
Google’s notes do not mention any of the 213 fixed flaws being exploited, but it recommends updating as soon as possible.
Why hasn’t my phone got the update yet?
Updates roll out in waves, and Samsung and other makers can take weeks. Check again regularly.
