A security fix only protects people once it reaches their device. This tracker follows major consumer-facing flaws in phones, browsers, routers and apps: when each was disclosed, when a fix shipped, and who is still exposed. It contains no exploit instructions.
As of November 9, 2026, 7:56 AM (New York time, EST). Each row is dated and sourced. Researcher-only claims and single-source details are marked.
The short version
The biggest risks right now are gaps, not unknown bugs. Google has a fix for Android's "SMS of Death" call-dropping flaw, but its published fix list stops at Android 14, and each phone maker sets its own rollout (Android bulletin). Google has no fix scheduled at all for GhostMap, a crash-loop flaw that matches its own definition of High severity (Bitdefender). And a Russia-linked campaign disclosed on November 4 got into phones using only flaws that Apple and Google had already patched, which means it worked purely on devices that had not updated (Ars Technica).
Patch-gap table
| Flaw or incident | Affected | Impact (no exploit details) | Disclosed | Fix | Still exposed | Exploited? | Sources |
|---|---|---|---|---|---|---|---|
| GhostMap (no CVE) | Android, versions 10 through 17 | A crafted app can trap a phone in a crash loop; a factory reset is the usual way out. Denial of service, no data theft | Nov 5, 2026 (Bitdefender) | None. Google told Bitdefender it is out of scope for a security update and passed it to a feature team | All Android versions Bitdefender tested, including a Pixel 10 on the Aug 5, 2026 patch | Bitdefender says it has not seen it used against anyone | Bitdefender; AOSP source; Android severity matrix (Google's reasoning known only through Bitdefender; Google has not commented publicly) |
| "SMS of Death" (CVE-2026-58882) | Android telephony | Critical remote denial of service: a crafted message can crash the phone process and drop calls, including emergency calls, with no user interaction. Not code execution | Reported to Google May 5; public around Oct 29, 2026 | Google bulletin Nov 2, patch level 2026-11-01, for Android 14–17. Samsung's November update (published Nov 3) includes it | Android 12 and 13 (not on Google's fix list) and any phone still waiting for its maker's November update | Public proof-of-concept discussed; no confirmed attacks in the sources we reviewed | Android bulletin; OSV; Samsung SMR Nov 2026 (persistence claims are researcher-reported) |
| CVE-2026-86950 (CoreGraphics) | iPhone and iPad | Processing a malicious file may lead to arbitrary code execution | Sep 28, 2026 | iOS and iPadOS 26.7.1 (Sep 28); backported to iPhone XS/XR and older iPads in late October | Devices that have not installed the update | Yes, per Apple: possibly used in an extremely sophisticated attack against specific targeted individuals | Apple; BleepingComputer (exploitation details not disclosed by Apple) |
| CVE-2026-87491 (Chrome V8) | Google Chrome desktop | High-severity memory flaw that can let a crafted web page run code inside the browser's sandbox | Sep 8, 2026 (Google advisory) | Chrome 153.0.8010.36 (Windows, Linux) and 153.0.8010.37 (Mac), Sep 8, 2026 | Browsers not updated and restarted | Yes, per Google; the seventh exploited Chrome zero-day of 2026 | BleepingComputer (attack details withheld by Google) |
| APT29-linked watering-hole campaign (n-days) | iOS 16.7 and 18.5; Chrome for Android 139–145 (except 143) | Visiting a compromised or lookalike website could trigger exploit chains that stole cookies, messaging databases, credentials and Wi-Fi passwords | Nov 4, 2026 (Sekoia) | All flaws already patched by Apple and Google, including on older iOS releases | Out-of-date phones and browsers only | Yes, against outdated devices; no persistence after reboot | Sekoia; Ars Technica; BleepingComputer (attribution is Sekoia's moderate-to-high confidence assessment) |
| CVE-2026-0625 (D-Link DSL routers) | D-Link DSL-526B, DSL-2640B, DSL-2740R, DSL-2780B | Unauthenticated remote command execution on the router | Jan 6, 2026 | None. The models are end-of-life and get no security updates; D-Link recommends replacing them | Every remaining unit of the affected models; D-Link says it is reviewing firmware on other legacy and supported products | Yes; Shadowserver observed exploitation from Nov 27, 2025, per D-Link | BleepingComputer; D-Link advisory |
| Chainalysis platform breach | Chainalysis platform accounts (not people whose wallets it analyzes) | Names, usernames, password hashes and live tokens for all platform users exposed; a subset of passwords intercepted | Oct 30, 2026; all-user scope disclosed Nov 5 | Mandatory credential resets and API-key rotation; Reactor, KYT and Address Screening back Nov 7. As of the Nov 8 status update, the Customer Admin Portal and Training Academy were still offline and the Investigations API and Rapid Lookup were under maintenance; a password-reset error on Nov 8 was resolved the same day | Accounts whose credentials or tokens were not rotated | Yes; the company notified KYT customers whose accounts appeared to be accessed without authorization | Chainalysis advisory; Chainalysis status; The Record (company disclosure; hashing scheme and token scope not published) |
| Android November 2026 critical flaws (CVE-2026-58868, CVE-2026-58876, CVE-2026-58936 and others) | Android 14 through 17, plus chip components from MediaTek, Qualcomm and others | Critical remote code execution in the Framework and System components that needs no user interaction, plus critical kernel (Bluetooth) and MediaTek modem flaws | Nov 2, 2026 (bulletin; revised Nov 6) | Patch level 2026-11-01 for the platform fixes; 2026-11-05 covers everything in the bulletin, including kernel and chip fixes | Phones still waiting for their maker's November update; Android 12 and 13 are not listed as updated versions for these flaws | The bulletin does not mark any of these as exploited | Android bulletin (severity is Google's own rating) |
| Chrome 157 security release (seven Critical flaws, including CVE-2026-121229) | Chrome for Windows, Mac, Linux and Android | 213 security fixes. One Critical flaw in Chrome for Android could let a crafted web page run code outside the browser sandbox | Nov 3, 2026 | Chrome 157.0.8103.38/.39 (desktop) and 157.0.8103.38 (Android), rolling out over days to weeks | Browsers not yet updated and restarted | Not reported as exploited in the sources we reviewed | Malwarebytes (details summarized by Malwarebytes from Google's release notes) |
| CVE-2024-27834 (Apple WebKit pointer-authentication bypass) | iPhone, iPad, Mac, Apple TV, Apple Watch and Safari versions older than the May 2024 fixes | Lets an attacker who already has some control get past one of Apple's memory protections; usually one link in a longer chain | Fixed May 13, 2024; added to CISA's exploited list Nov 4, 2026 | iOS 17.5 and iOS 16.7.8 (May 2024) and later; current releases are iOS 27.2, 26.7.2 and 18.7.11 | Apple devices that stopped updating before May 2024 | Yes, per CISA's Known Exploited Vulnerabilities catalog; federal agencies must patch by Nov 18 | CISA; NVD; Apple security releases (CISA has not said who used it or against whom) |
| NTT Docomo Online Shop and My docomo breach | Docomo mobile customers in Japan | Names, birth dates, addresses, phone numbers, email addresses, ID-document numbers and contract details for up to about 300,000 customers; bank account details and employer or legal-representative details for some | Unauthorized access detected Nov 4, 2026; services halted Nov 5; fourth update Nov 9 | Docomo says it has countered the access route it found; most My docomo procedures resumed around 3 p.m. Japan time on Nov 9, while the online shop and some procedures stay offline | Affected customers face phishing calls, texts and emails that use the leaked details | Yes; data was taken. Docomo says no new leaks have been confirmed and it is still investigating the cause, route and full scope | NTT Docomo notice (Japanese); Nippon TV (company disclosure; count is a maximum and may be revised) |
How to check whether you are covered
- Android: Settings shows a security patch level. For CVE-2026-58882 and the November platform flaws, Google's bar is 2026-11-01 or later; 2026-11-05 covers every fix in the November bulletin. GhostMap has no fix, so avoid installing apps from outside well-policed stores and keep backups current.
- iPhone and iPad: iOS 26.7.1 or later covers CVE-2026-86950. Apple's current releases are iOS 27.2, iOS 26.7.2 and, for iPhone XS and XR, iOS 18.7.11 (Apple security releases). A device that stopped updating in early 2024 is also open to CVE-2024-27834, which CISA now lists as exploited.
- Chrome: Version 157.0.8103.38 or later (153.0.8010.36 was the minimum for the September zero-day), and the browser must be restarted to apply it.
- Routers: If your router is end-of-life, no fix is coming. The affected D-Link models should be replaced.
- Breached services: Rotate passwords, sessions and API keys when a provider tells you to, even if the service is back online. After a carrier breach like Docomo's, treat calls and texts that quote your contract details as suspect.
What changed recently
- Nov 9 update: Added four rows: Android's November critical flaws (Android bulletin), the Chrome 157 security release (Malwarebytes), CISA's listing of the 2024 Apple flaw CVE-2024-27834 as exploited (CISA), and the NTT Docomo customer-data breach (NTT Docomo notice (Japanese)). Updated the Chainalysis row with the Nov 8 status page and the patch-check advice with current Chrome and iOS versions.
- Nov 9: Docomo said it had countered the intrusion route it found and reopened most My docomo procedures; the online shop remains offline (NTT Docomo notice (Japanese)).
- Nov 6: Google revised the November Android bulletin's issue list (Android bulletin).
- Nov 4: CISA added CVE-2024-27834, an Apple flaw fixed in May 2024, to its exploited-vulnerabilities catalog (CISA). It fits the pattern of the APT29-linked campaign below: attacks that work only on devices that stopped updating.
- Nov 3: Google shipped Chrome 157 with 213 security fixes, seven rated Critical (Malwarebytes).
- Nov 7–8: Chainalysis restored Reactor, KYT and Address Screening but said recovery work was continuing (Chainalysis advisory; Chainalysis status). See our Chainalysis breach report.
- Nov 5: Bitdefender published GhostMap and said Google would not ship it as a security fix (Bitdefender). See our GhostMap analysis.
- Nov 4: Sekoia reported APT29-linked watering-hole attacks on outdated iOS and Android devices (Sekoia).
- Nov 2–3: Google's November bulletin and Samsung's November update listed the SMS of Death fix (Android bulletin; Samsung SMR Nov 2026). See our SMS of Death explainer.
What to watch next
- Other Android makers' November updates, and whether any publish a backport of the SMS of Death fix to Android 12 or 13.
- Google's position on GhostMap. A CVE or a bulletin entry would move the row from "no fix" to "fix available."
- Chainalysis' full incident report, including where password interception occurred and how long stolen tokens stayed valid.
- Docomo's final count and cause. The carrier says the up-to-300,000 figure and the intrusion route are still under investigation.
- Exploitation of the November Android flaws. Google would mark any confirmed in-the-wild use in a bulletin revision.
- Nov 18: CISA's deadline for federal agencies to fix CVE-2024-27834.
- The December Android and Apple security releases, which we will add as they publish.
Methodology
We include flaws and breaches that affect consumer devices or widely used apps and services, prioritizing ones that are exploited, publicly disclosed without a fix, or slow to reach users. Vendor bulletins and advisories come first, followed by the original researchers and established security outlets. "Exploited" means the vendor or a credible researcher says so; we do not infer exploitation from the existence of a proof-of-concept. We describe impact in plain terms and never publish exploit steps. Rows are updated when a fix ships, a major vendor rolls it out, exploitation is confirmed, or a vendor changes its position, and every update is dated.