3 NOV 2026 — Google has confirmed the Android "SMS of Death" flaw and rated it Critical in its November security bulletin, published on 2 November. Our report that day found the flaw missing from October's bulletin, and November's was not online when we looked.
The entry confirms what the flaw is and which patch level fixes it. But the bulletin lists fixes only for Android 14 to 17 and says nothing about Android 12 or 13.
Four things yesterday's report could not say
| Question | Before 2 November | Now |
|---|---|---|
| Is the flaw in a Google bulletin? | Not in October's | Yes, as CVE-2026-58882, type denial of service, severity Critical |
| Is there a public CVE record? | None at MITRE or NIST | Yes, published by Google at 03:54 SGT on 3 November |
| Which patch level covers it? | The researcher said October 2026 | Google lists it at 2026-11-01 |
| Is a manufacturer shipping it? | Unknown | Samsung lists it in its November maintenance release, which it describes as for major flagship models |
The third row in the table changes our advice. We had passed on the researcher's statement that an October 2026 patch level or later is protected. Google places the fix one month later, so the safer check in Settings is for 2026-11-01 or newer. Google's record describes the bug as an out-of-bounds read caused by an integer overflow that "could lead to a remote denial of service" with no user interaction.
Where Android 12 and 13 went
We read every row of the bulletin. It lists 216 distinct CVEs: 119 at the 2026-11-01 level and 97 at 2026-11-05. By our count, 23 are rated Critical. The worst, in Google's words, is a Framework flaw that "could lead to remote code execution". Of the 119 rows carrying an Android version, none names 12 or 13.
That pattern predates this flaw. The December 2025 bulletin still listed fixes for Android 12 and 13. By March 2026 every row started at 14.
Google's CVE record names versions 14 to 17 as affected and sets the default status for everything else to "unaffected". The researcher reports reproducing the crash from Android 12 upward. The two statements conflict, but we would not treat Google's as a test result. Two other records from this bulletin that we opened, CVE-2026-58814 and CVE-2026-58868, carry the same version list and the same default, so this looks like boilerplate.
The bulletin does say that "Devices with Android 10 and later may receive security updates", so a manufacturer could still patch an older phone. We found no Google statement on Android 12 or 13 and no manufacturer notice covering them. In October, Android 12 and 13 made up 10.32% to 23.36% of Android phone web traffic across six ASEAN markets, according to the StatCounter figures in our earlier report. Web traffic is not a phone count.
View author profile → · Editorial policy
