Follow us on Google News
Google has released security fixes for a critical Android vulnerability that could allow a remote attacker to execute code on a device without requiring any interaction from the user.
The flaw, tracked as CVE-2026-58868, affects Android versions 14 through 17 and was addressed in Google’s November 2026 Android security update. Devices with the Android security patch level dated November 1, 2026, or later include the fix.
Google had not reported any known exploitation of the vulnerability as of November 4, and the flaw was not listed in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue as of its November 3 update.
Critical Flaw Could Enable Zero-Interaction RCE
CVE-2026-58868 is an out-of-bounds write vulnerability caused by a heap buffer overflow in the onOutputReceived function of Android’s FrameDecoder.cpp.
Google classified the issue as Critical because, under certain conditions, it could allow remote code execution without additional execution privileges or user interaction.
The public bulletin and CVE record do not explain how an attacker would reach the vulnerable code path.
Google’s severity assessment assumes that Android’s built-in security protections and Google services are either disabled or successfully bypassed.
Older Android versions, including Android 12 and Android 13, are not listed as affected by CVE-2026-58868. However, the available records do not clarify whether the same vulnerable code exists in those releases.
November Update Uses Two Patch Levels
Google’s November bulletin uses two security patch levels.
Devices with the 2026-11-01 patch level include fixes for vulnerabilities in Android Framework, System and runtime components, including CVE-2026-58868.
Devices with the 2026-11-05 patch level include all fixes from the November bulletin, including vulnerabilities affecting the Android kernel and components supplied by Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm.
Google uses separate patch dates so device manufacturers can distribute fixes for common Android components more quickly.
The company encourages manufacturers to include all available fixes wherever possible.
Users can check their patch level by opening the device Settings menu, selecting About phone or About tablet, and viewing the Android security update date.
Another Critical Android Flaw Affects WAP Push Messages
The November bulletin also includes CVE-2026-58882, another Critical vulnerability that could allow a remote denial-of-service attack without user interaction.
The flaw affects Android code responsible for decoding WAP Push messages delivered through SMS.
A researcher who publishes under the name Mark B recently described a flaw in the same function as an “SMS of Death.”
According to that research, a specially crafted WAP Push message could crash the com.android.phone process, terminating active calls, including potentially emergency calls.
The malformed message reportedly does not appear in the normal message inbox.
Researchers also reported that a vulnerable phone could repeatedly process the malicious message after restarting, potentially causing repeated crashes until the message is removed.
Google’s security bulletin does not explicitly state whether CVE-2026-58882 is the same vulnerability described in that public research.
November Bulletin Fixes 216 Vulnerabilities
Google’s November Android security bulletin addresses 216 vulnerabilities in total.
Twenty-three of those issues are rated Critical.
In addition to CVE-2026-58868, two other Critical vulnerabilities, CVE-2026-58876 and CVE-2026-58936, affect Android’s System component and could potentially allow remote code execution.
Several Critical vulnerabilities were also fixed in the Android kernel.
Two of those affect Bluetooth-related code, while the most severe kernel issue could allow a remote attacker to obtain elevated privileges without user interaction.
The November 5 patch level also includes fixes for Critical vulnerabilities in MediaTek modem components and a closed-source Qualcomm component.
MediaTek said it was not aware of active exploitation of the Critical modem vulnerabilities covered in its November security bulletin.
Google Play Updates Cover Some Android Flaws
Devices running Android 10 or later can receive some security fixes through Google Play system updates.
The November Google Play update list includes CVE-2026-58876, another Critical vulnerability.
However, CVE-2026-58868 is not included in that mechanism.
Users specifically concerned about CVE-2026-58868 should therefore check the Android security patch date on their device rather than relying only on the Google Play system update date.
A security patch level of November 1, 2026, or later covers the flaw.
No Workaround for Devices Awaiting Updates
Google’s bulletin does not provide a temporary workaround for devices that have not yet received the relevant security patch.
Android security updates are distributed by individual device manufacturers and mobile carriers, meaning the timing of availability can vary significantly between devices.
Users whose phones are still receiving security support should install the November update as soon as it becomes available.
Devices that no longer receive manufacturer security updates may remain exposed to vulnerabilities that cannot be corrected through Google Play system updates alone.
No Known Exploitation Reported
Despite the severity of CVE-2026-58868, there was no public indication as of November 4 that attackers were exploiting the flaw in real-world attacks.
It had also not been added to CISA’s Known Exploited Vulnerabilities catalogue.
That distinction is important because the vulnerability represents a potentially serious attack path, but there is currently no evidence that it is being actively weaponised.
The November update nevertheless highlights the importance of keeping Android devices current, particularly when flaws can potentially be exploited remotely without requiring a victim to open a file, install an application or interact with a malicious message.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
