Android’s November update fixes a hidden text that can drop your calls

Google’s November Android security update fixes a flaw that can crash the part of your phone that handles calls, using a hidden text you never see. Google rates it critical. Here is how to check whether your Android security update has arrived, and what the date on it needs to say.

What changes for you: this is not a bug that needs you to tap a bad link. According to the researcher who found it, the phone handles the message in the background, so the only real protection is the update itself.

What the call crash bug does

Google lists the flaw as CVE-2026-58882 in its November 2026 Android security bulletin. It sits in the System part of Android, it is a denial of service bug (one that stops something from working rather than stealing data), and Google rates it critical. It affects Android 14, 15, 16, 16 QPR2 and 17.

Security researcher Mark Blaszczyk, who reported the flaw to Google, says a specially made WAP Push message, a type of behind-the-scenes text that phones use for things like network settings, can crash the phone’s calling service. He says it can end calls in progress, including emergency calls, without the message ever showing up in your inbox, and that repeated messages can make the crashes keep coming back. Those details come from his disclosure; Google’s bulletin confirms the flaw and its critical rating.

The other fixes in the November update

The call bug is not the only reason to update. Google says the most severe issue this month is a critical flaw in the Android Framework that could let an attacker run code on a phone remotely, with no extra permissions and no action from the user. The bulletin also lists fixes for the Android kernel and for chip parts made by companies such as MediaTek, Arm and Imagination Technologies.

Google’s bulletin does not say whether any of these flaws have been used in real attacks.

How to check your Android security update date

These steps come from Google’s own Android help page. Menu names can change a little between phone brands.

1. Open the Settings app.
2. Tap About phone (or About tablet), then Android version. On Samsung Galaxy phones, look under About phone, then Software information.
3. Find the line called Android security update and read the date.
4. If it says Nov. 1, 2026 or later, you have the call bug fix. If it says Nov. 5, 2026 or later, you have every fix in the November bulletin.

If your menus look different, type “security update” into the search bar at the top of Settings.

How to install the update

1. If you see an update notification, open it and tap the update button.
2. Or open Settings, tap System, then Software updates, and follow the steps on screen.
3. On the same screen, check for a Google Play system update too. Google sends some fixes that way.
4. Plug in your phone and connect to Wi-Fi first. Updates can be large and the phone will restart.

What if your phone does not show the November update?

Google publishes the fixes first, then each phone maker builds its own version and sends it out on its own timetable, and carriers can add more delay. Check again in a few days.

If your phone has not had any security update for months, it may be past the end of its support. Samsung owners can check our list of Samsung phones still getting security updates. If yours is off the list, our picks for the best phones under $500 can help you pick a replacement.

What we don’t know yet

Google has not said how many phones are affected, and phone makers have not all posted dates for the November update. We will update this story as the big brands confirm their rollouts.

Using an iPhone instead? Apple’s late October updates fixed more than 160 security flaws. Here is which iPhone update your phone needs.