CERT-In Android warning: update Android 14 to 17 phones to November patch

India's cyber-security agency CERT-In has warned users of Android 14, 15, 16, 16 QPR2 and 17 about multiple security flaws that could let attackers take control of a phone, in a vulnerability note (CIVN-2026-0536) published on Wednesday, 4 November 2026. The fixes are in Google's November 2026 Android Security Bulletin, published on 2 November, which patches 216 flaws, 23 of them rated critical. CERT-In has urged individuals and organisations to install the latest security update.

For many young people, the phone is where classes, payments, banking, social media, gaming and job applications all happen. A flaw that lets an attacker run code on the phone, especially one that needs no click from the user, puts all of that at risk. CERT-In, the Indian Computer Emergency Response Team, is the national agency that issues such warnings, and its advice applies to ordinary users as well as companies.

Two terms are worth knowing. A "vulnerability" is a weakness in software that an attacker can use. A "security patch level" is a date shown in your phone's settings that tells you which month's fixes have been installed. The Android version number alone, such as Android 15, does not tell you whether your phone is safe; the patch level does. If your phone shows a patch level of 2026-11-05, it has the full set of November fixes. A phone showing 2026-11-01 has the main system fixes but not every component.

The catch is that a bulletin is not the same as an update on your phone: each phone maker releases the fixes for its own models, so they do not reach every handset on the same day. Phones running Android 12 or 13 are not covered by this bulletin at all, according to reports, which leaves older and cheaper handsets more exposed. For students using hand-me-down or budget phones, that is a real risk.

What to do now: open your phone's settings and look for the software update or security update section, install any pending update, and then check the security patch level. Until an update arrives, CERT-In and security reports advise avoiding unknown links, not installing apps or files from outside official stores, and keeping Google Play Protect switched on. Being careful with SMS links matters too, given the "SMS of Death" bug in this month's list.

Peepals calculation: of the 216 flaws in the November bulletin, the 23 critical ones are about 11% (23 ÷ 216 ≈ 0.106) and the 193 high-severity ones about 89% (193 ÷ 216 ≈ 0.894). CERT-In's note came two days after Google's bulletin (2 November to 4 November). Our calculation from the reported figures.

Short-term: Users who install the November update close the reported holes; those who wait remain exposed, especially to the no-click flaw. Companies that manage staff phones will push the update across their devices.

Long-term: The gap between Google's fix and each phone maker's update remains the weak point. Phones on older Android versions that are outside this bulletin stay exposed to any of these flaws that affect them.

Who is affected: Anyone using a phone on Android 14 to 17, which includes many students and young professionals; organisations with Android devices; and phone makers that must release the patches.

Questions and Answers